Dynamic Taint Analysis for Web Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional black-box security testing for web applications is time-consuming due to limited visibility into the application's code, leading to numerous unnecessary attacks being performed, which slows down the scanning process, especially on large websites.
Innovation Solution
Implementing a dynamic taint analysis module that reports possible vulnerability categories to the scanner, allowing it to selectively scan and prioritize attacks based on identified vulnerabilities, thereby reducing the number of tests required.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional black-box security testing is used to scan the application under test, then the scanner can identify vulnerabilities without internal code insight, but the scanning process becomes time-consuming due to numerous unnecessary attacks being performed
Solution Approach 1:
The patent applies preliminary action by performing dynamic taint analysis during the crawling phase to pre-identify vulnerability categories before the attack phase. The scanner collects information about the application's code during crawling, performs taint analysis to determine which inputs can reach sensitive functions, and uses this information to guide subsequent attacks. This preliminary identification of vulnerable entry points eliminates the need to perform exhaustive attacks on all URLs, significantly reducing scanning time while maintaining reliable vulnerability detection.
2Reliability
If the scanner performs extensive attacks on all attack surface URLs, then comprehensive vulnerability coverage is achieved, but the number of unnecessary attacks increases, reducing scanning efficiency
Solution Approach 1:
The patent applies local quality by making different parts of the scanning process have different levels of analysis intensity. Instead of uniformly applying exhaustive attacks to all URLs, the system performs dynamic taint analysis to identify which specific entry points have the potential to reach sensitive functions. Only those locally identified vulnerable entry points receive intensive attack coverage, while other URLs receive minimal or no attacks. This localized approach maintains comprehensive vulnerability coverage for actually vulnerable points while eliminating wasted attacks on non-vulnerable URLs.
3Ease of operation
If the scanner operates without insight into internal code workings, then black-box testing simplicity is maintained, but the scanner cannot distinguish between necessary and unnecessary attacks
Solution Approach 1:
The patent introduces an intermediary dynamic taint analysis module that bridges the gap between black-box simplicity and white-box insight. This intermediary component is integrated into the scanner and automatically performs code instrumentation and taint tracking without requiring manual code review or complex configuration by the user. The intermediary analyzes the application's internal code flow during crawling, determines which inputs can reach sensitive functions, and uses this information to guide attacks. This maintains ease of operation for the end user while incorporating sophisticated analysis capabilities through the automated intermediary module.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Example embodiments disclosed herein relate to generating a scanning strategy based on a dynamic taint module. A dynamic taint module associated with an application is caused to be initiated for a crawling phase of a security test. A report is received from the dynamic taint module. The dynamic taint module is restricted. The scanning strategy is based on the report.