Web Application Scanner Authentication Switching for Reliable Scans
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications are vulnerable to attacks due to their exposure to public internet, and existing web application scans often lack efficiency in identifying and addressing vulnerabilities, particularly when multiple authentication types are required.
Innovation Solution
A method for web application scanning that involves obtaining a set of user credentials during configuration, attempting authentication using multiple authentication types sequentially until successful, and automatically switching to a different authentication type if the initial attempt fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple authentication types are attempted sequentially, then authentication reliability is improved, but scan time increases
Solution Approach 1:
The system performs preliminary actions by attempting multiple authentication types in sequence before proceeding with the vulnerability scan. The scanner tries different authentication mechanisms (e.g., basic auth, form-based auth, certificate auth) in a predetermined order, and only proceeds with the scan after successful authentication is established. This ensures reliable authentication while managing time through structured sequential attempts rather than random retries.
2Adaptability or versatility
If multiple authentication types are configured, then authentication versatility is improved, but configuration complexity increases
Solution Approach 1:
The authentication configuration is segmented into distinct authentication type modules, each handling a specific authentication mechanism (e.g., HTTP basic auth, form-based auth, certificate-based auth). The system divides the overall authentication process into separate configurable segments, allowing each authentication type to be independently configured and managed. This reduces configuration complexity by organizing multiple authentication types into modular, manageable units rather than a monolithic configuration system.
3Reliability
If automatic authentication switching is implemented, then authentication success rate is improved, but processing overhead increases
Solution Approach 1:
The authentication system implements self-service by automatically switching between different authentication types without requiring manual intervention. When the initial authentication attempt fails, the scanner autonomously tries alternative authentication mechanisms in sequence, selecting and executing the appropriate authentication method based on the response received. This automatic self-service approach improves authentication success rates while minimizing processing overhead by eliminating the need for manual reconfiguration or intervention.
Data Source
AI summary
In an embodiment, a component of a web application scanner for scanning of a web application obtains a set of user credentials during a scan configuration session, the set of user credentials associated with a plurality of authentication types, and generates a first configuration associated with a first authentication type of the plurality of authentication types based on the set of user credentials. The component performs a first attempt to authenticate the web application scanner with the web application based on the first configuration. The component automatically and selectively performs a second attempt to authenticate the web application scanner using the set of credentials via a different authentication type based on whether the first attempt is verified as successful.