Client-Side Code Evaluation for Web Application Security Testing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Black-box testing of web applications cannot identify security vulnerabilities in client-side code, as these interactions are limited to the server side and do not account for code executed on the client's computer.

Innovation Solution

A system comprising a black-box tester interacting with a web application at a computer server to identify client-side instructions and a client-side evaluator that performs static or dynamic taint analysis to detect security vulnerabilities in the client-side code, using a predefined security specification to track taint propagation and identify tainted objects.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If black-box testing is performed only at the server side, then the testing process is simple and manageable, but security vulnerabilities in client-side code cannot be detected

Engineering Contradiction:

Improvesecurity vulnerability detection capabilityVSAvoidtesting system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The testing system is divided into two independent components: a server-side black-box tester that interacts with the web application and a client-side evaluator that analyzes client-side code. This segmentation allows each component to specialize in its specific function, enabling comprehensive security testing without requiring complete system reconfiguration

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The server acts as an intermediary that receives client-side code from the web application and forwards it to the evaluator. This intermediary mechanism enables the testing system to access and analyze client-side code without requiring direct client-server communication or complex client-side instrumentation

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If client-side code evaluation is added to black-box testing, then security vulnerability detection is improved, but the complexity of the testing system increases

Engineering Contradiction:

Improvesecurity vulnerability detection capabilityVSAvoidtesting system structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The server performs multiple functions: it acts as both the web application server and the intermediary for code evaluation. The evaluator also performs multiple functions by extracting, analyzing, and evaluating client-side code within a single component, reducing the need for additional specialized systems

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The web application itself provides the client-side code that needs to be evaluated by returning it to the server during normal operation. This self-service approach eliminates the need for separate code extraction mechanisms or additional instrumentation of the application

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS9032528B2Black-box testing of web applications with client-side code evaluation

Publication Date: 2015.05.12 FINJAN BLUE INC

AI summary

Detecting security vulnerabilities in web applications by interacting with a web application at a computer server during its execution at the computer server, identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server, evaluating the identified client-side instructions, and identifying a security vulnerability associated with the client-side instructions.