Real-Time Modifier for Automated Security Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional black-box security testing for web applications is hindered by features like CAPTCHA, authentication mechanisms, and validation processes that prevent automated tools from performing in-depth analysis, limiting the detection of vulnerabilities.
Innovation Solution
A real-time modifier system that modifies the behavior of the application under test during execution without altering the compiled code, allowing automated tools to bypass security validation and access restricted areas, enabling deeper analysis and vulnerability detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If traditional black-box security testing is used, then automated vulnerability scanning can be performed, but security validation features (CAPTCHA, authentication, validation processes) block access to restricted areas and prevent in-depth analysis
Solution Approach 1:
The patent introduces a test account with elevated privileges as an intermediary entity. This test account acts as a mediator between the automated scanning tool and the restricted areas of the application, allowing the scanner to bypass normal authentication and validation barriers without modifying the application code. The test account enables the scanning tool to access protected resources that would otherwise be inaccessible to automated tools.
Solution Approach 2:
The patent performs preliminary configuration by creating a special test account with elevated privileges before the security scanning process begins. This preliminary action establishes the necessary conditions for the automated tool to access restricted areas during the scan, allowing the testing to proceed without encountering authentication blocks.
2Reliability
If security validation features are implemented to protect the application, then security is improved, but automated testing tools cannot perform in-depth analysis of protected areas
Solution Approach 1:
The test account serves as a mediator that temporarily bypasses security validation features during automated testing. It allows the scanning tool to access protected areas without disabling or modifying the actual security mechanisms, thus maintaining application security while enabling thorough vulnerability assessment.
Solution Approach 2:
The patent changes the authentication parameters by using a special test account with different credentials and elevated privileges compared to normal users. This parameter change allows the automated tool to access restricted areas without altering the application's security validation logic or compromising the security of production environments.
3Measurement precision
If manual security testing is performed to overcome validation barriers, then in-depth analysis is possible, but testing efficiency and productivity decrease
Solution Approach 1:
The test account acts as an automated intermediary that eliminates the need for manual intervention to bypass validation barriers. Automated scanning tools can use this test account to access restricted areas programmatically, maintaining the thoroughness of in-depth analysis while restoring automation efficiency and eliminating manual testing steps.
Data Source
AI summary
Example embodiments disclosed herein relate to actively modify execution at runtime of an application under test (AUT). The AUT is executed using a real-time modifier. A security test is performed on the AUT. Execution of the AUT is modified at a decision point.