Runtime Instrumentation Engine Emulates Super User Role

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional black-box security testing for web applications is limited in identifying vulnerabilities in administrative functions without requiring multiple user credentials, as it cannot simulate a power user role to uncover protected URLs.

Innovation Solution

The use of a Runtime Instrumentation Engine to emulate a super user role, allowing a web application scanner to find hidden pages and orphan pages by modifying the program code at runtime, thereby bypassing authorization checks and comparing HTML outputs between regular and super user modes for differential analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If traditional black-box security testing is used, then the testing process is simple and does not require internal code modification, but it cannot detect vulnerabilities in administrative functions without multiple user credentials

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidtesting system complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The patent introduces a runtime instrumentation engine as an intermediary component that sits between the scanner and the application under test. This engine intercepts authorization check function calls and modifies their execution to simulate power user roles, enabling the scanner to access administrative functions without requiring actual multiple user credentials while maintaining a relatively simple testing workflow

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If multiple user credentials are required to test administrative functions, then comprehensive vulnerability coverage is achieved, but the testing process becomes more complex and time-consuming

Engineering Contradiction:

Improvevulnerability coverageVSAvoidtesting time

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The patent changes the parameter of user authorization status by intercepting and modifying the execution of authorization check functions at runtime. Instead of actually switching between multiple user credentials, the instrumentation engine alters the return values of authorization functions to simulate having power user privileges, thereby achieving comprehensive vulnerability coverage while significantly reducing testing time

Inventive Principle:

Principle #35Parameter changes

3Difficulty of detecting and measuring

If the application code is modified to enable power user mode, then vulnerability detection is enhanced, but the application's code integrity is compromised

Engineering Contradiction:

Improveaccess to protected URLsVSAvoidcode integrity

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent replaces the mechanical approach of permanently modifying application code with a runtime instrumentation approach. Instead of altering the actual application source code, the system uses bytecode manipulation and runtime code interception to dynamically enable power user mode during testing, thereby maintaining code integrity while still enabling enhanced vulnerability detection capability

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS9953169B2Modify execution of application under test so user is power user

Publication Date: 2018.04.24 MICRO FOCUS LLC

AI summary

Example embodiments disclosed herein relate to modifying execution of an application under test to act as if a user is a power user. The application under test is hosted in a real-time modifier. A security crawl is performed on the application under test logged in as the user. The user is treated as a power user.