Web Application Vulnerability Scanning via Dynamic Interaction Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web application scanners are inefficient and ineffective in scanning complex, asynchronous, and sequence-specific web applications due to their inability to accurately mimic user interactions, leading to time-consuming trial-and-error approaches, false positives/negatives, and potential vulnerabilities in the scanning process.
Innovation Solution
A web scanner system that dynamically determines actions to simulate user interactions based on historical interaction data, allowing for customized scanning that mimics typical user actions, reducing unnecessary resource expenditure and minimizing vulnerabilities during the scanning process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional web application scanners use predetermined guessing or trial-and-error approaches to scan web applications, then they can identify some vulnerabilities, but the scanning process becomes very time and resource consuming and ineffective for complex web applications
Solution Approach 1:
The patent creates a virtual model (copy) of the web application by injecting scripting code that captures runtime data, DOM structure, and application behavior. This virtual model allows the scanner to analyze vulnerabilities in the copied environment rather than repeatedly testing the actual application through time-consuming trial-and-error approaches, thereby maintaining accuracy while dramatically reducing scanning time.
Solution Approach 2:
The patent performs preliminary actions by injecting scripting code into the web application during its normal execution to pre-capture runtime data, DOM snapshots, and application state information. This preliminary data collection occurs as part of the application's normal operation, so when vulnerability scanning is needed, the data is already available, eliminating the need for repeated trial-and-error testing and reducing overall scanning time.
2Adaptability or versatility
If web application scanners manually select certain aspects of the website to scan, then targeted scanning can be performed, but the process requires significant human intervention and division of scanning into separate scans
Solution Approach 1:
The patent creates a universal scanning system that can automatically adapt to scan any web application without requiring manual configuration. The injected scripting code universally captures runtime data, DOM structure, and application behavior across different web applications, enabling the scanner to automatically identify scan targets and perform comprehensive vulnerability assessment without human intervention, thus maintaining adaptability while improving ease of operation.
3Adaptability or versatility
If web applications are designed to be executable in substantially the same manner across multiple operating systems and browser platforms, then broad availability is achieved, but vulnerabilities can affect multiple platforms simultaneously and are harder to detect
Solution Approach 1:
The patent creates a unified virtual model (copy) of the web application that captures its behavior across different platforms. By injecting scripting code that runs within the application's execution context regardless of the underlying platform, the system captures platform-specific runtime data and DOM structure in a standardized format, allowing vulnerability detection without being hindered by cross-platform variability.
Data Source
AI summary
Present example embodiments relate generally to scanning websites, wherein the devices, methods, and logic for the scanning comprises receiving interaction information between a user computing device and a web application of the website; dynamically determining an action to be performed to the web application that approximately simulates the user computing device interacting with the web application, wherein the action is dynamically determined based on the received interaction information; establishing a browsing session with the website; discovering the web application within the website; and identifying a vulnerability of the web application by interacting with the web application using the action.