Web Application Vulnerability Retesting via Response Logging

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing web application security scanning methods face challenges in efficiently identifying and verifying vulnerabilities, particularly in complex applications, due to the vast variety of possible responses and the need for manual review, which can lead to missed vulnerabilities and false positives.

Innovation Solution

An external test system interacts with the web application, logs responses, compares them to expected vulnerabilities, and generates retest scripts to recreate detected vulnerabilities without reexecuting the entire test schedule, allowing for targeted retesting and verification by human experts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual review of all code and files is performed to verify security, then security verification thoroughness is improved, but time consumption and operational complexity increase significantly

Engineering Contradiction:

Improvesecurity verification thoroughnessVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables automated self-testing of the web application through virtual execution environments that automatically execute test schedules, log responses, and generate retest scripts without requiring manual intervention for each test case, thereby reducing time consumption while maintaining thoroughness

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Manual security review processes are replaced with automated external testing systems that programmatically interact with the web application, execute test schedules, compare responses to expected outcomes, and generate verification reports, substituting human manual review with automated mechanical systems

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Difficulty of detecting and measuring

If comprehensive security testing is performed on complex web applications, then vulnerability detection capability is improved, but device complexity and operational difficulty increase

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidtesting system complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The testing system is segmented into modular components including test schedule management, virtual execution environments, response logging modules, comparison engines, and retest script generators. Each component handles a specific aspect of security testing independently, reducing overall system complexity while maintaining comprehensive vulnerability detection capability

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The external testing system is designed as a universal platform that can test multiple web applications through standardized interfaces and schedules. The same system architecture handles different application types by configuring test schedules and expected responses, eliminating the need for separate complex testing systems for each application

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Productivity

If automated testing of web applications is implemented, then productivity and scanning speed are improved, but measurement precision and accuracy of vulnerability detection may deteriorate

Engineering Contradiction:

Improvescanning speedVSAvoidvulnerability detection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system incorporates feedback mechanisms where responses from the web application under test are logged and compared against expected responses defined in test schedules. This feedback loop enables automated systems to verify detection accuracy by checking whether identified vulnerabilities actually produce the expected behavior, allowing continuous improvement of detection precision while maintaining high productivity

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9239745B1Method and apparatus for managing security vulnerability lifecycles

Publication Date: 2016.01.19 BLACK DUCK SOFTWARE INC

AI summary

Vulnerability testing of a web application can be done using external testing, wherein an external test system runs with permissions of a user of the web application and interacts with the web application over a network, the external test system might obtain a schedule for a vulnerability test, execute the schedule using the external test system, log at least portions of responses of the web application to interactions of the external test system with the web application, compare portions of the responses to expected possible responses associated with particular possible vulnerabilities of the web application, thereby detecting possible vulnerabilities of the web application and, for at least one detected possible vulnerability, generating a retest script that comprises at least instructions to place the web application in a state at least similar to the state at which the at least one detected possible vulnerability was detected during execution of the schedule and that comprises at least instructions to interact with the web application in an attempt to recreate the detection without requiring reexecution of the schedule.