METHODS FOR DETERMINING CROSS-SITE SCRIPTING AND RELATED VULNERABILITIES IN APPLICATIONS

摘要

The invention provides computer-implemented methods and computer systems for testing applications such as web-based (HTTP) applications for cross-site scripting (XSS) and related security vulnerabilities and permits the discovery of previously unknown XSS and related vulnerabilities in applications without relying on known or previously generated static XSS signatures. The invention may be applied to any type of XSS or related vulnerability for any variation of application code.

主权项

1. A computer-implemented method for testing an application for cross-site scripting vulnerabilities, comprising the steps of:
under control of at least one processor,
(a) for at least one field, parameter or URL of the application, submitting a request in which the field, parameter or URL contains a test slug consisting of an encoded or non-encoded test character or a string of test characters between two default slugs;(b) determining if the application returns the test slug with the test character or string of test characters and whether any of the test characters in the test slug are transformed or not transformed in the returned test slug;(c) storing in tangible computer memory the result of the determinations made in step (b); and(d) repeating steps (a)-(c) for a plurality of different test characters or strings of test characters.