Web Application Scanner Server State Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web application security scanners face challenges in maintaining server-side state during scanning, particularly in staying logged in, due to unpredictable responses and the need for manual configuration of session identifiers, which leads to inefficiencies and performance overhead.
Innovation Solution
A computer-implemented method and system that monitors executed code, retrieves code coverage information, and correlates it with scanning information to determine changes in server-side state, allowing for accurate identification and tracking of server-side state without manual configuration, using techniques like injecting task-specific monitoring code and heuristics to identify login and other server-side states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a scanner sends heartbeat requests to detect login state, then the accuracy of detecting login state is improved, but performance overhead increases
Solution Approach 1:
The system automatically extracts session identifiers from scanned web application responses without requiring manual user configuration. The scanner self-configures by monitoring responses and identifying session ID patterns autonomously, eliminating the need for users to manually search and configure session ID locations.
Solution Approach 2:
The system monitors web application responses to detect when session identifiers change or expire. By continuously feedback on response content analysis, the scanner can automatically detect login state changes and refresh session identifiers, replacing the need for separate heartbeat requests while maintaining detection accuracy.
2Reliability
If a scanner manually configures session identifiers, then the ability to track login state is improved, but ease of operation deteriorates
Solution Approach 1:
The system automatically extracts session identifiers from scanned web application responses without requiring manual user configuration. The scanner self-configures by monitoring responses and identifying session ID patterns autonomously, eliminating the need for users to manually search and configure session ID locations.
Solution Approach 2:
The system introduces an automatic session identifier extraction mechanism that acts as an intermediary between the scanner and the web application. This intermediary automatically identifies and tracks session identifiers in responses, replacing manual user configuration with automated detection and management.
3Reliability
If a scanner reviews all test responses to detect login state, then comprehensive monitoring is improved, but device complexity increases
Solution Approach 1:
The system extracts and focuses on specific session identifier patterns from web application responses rather than analyzing all response content. By isolating and monitoring only the relevant session ID elements, the system reduces detection complexity while maintaining reliability through targeted pattern matching.
Data Source
AI summary
A computer-implemented method, system, and computer program product for detecting and monitoring server side state during the scanning of a web application. The method includes: monitoring executed code of the web application while scanning the web application; retrieving code coverage information from the monitoring of the executed code and retrieving scanning information from the scanning of the web application; correlating the code coverage information with the scanning information; and determining a change in the server side state based on the correlation. The system includes one or more devices that executes the steps of the method. The computer program products includes computer program instructions stored on a computer readable storage medium, where the instructions, when executed, will cause a computer to perform the steps of the methods.