Patent ID: 9239745
Filing Date: 2016-01-19
CPC Classification: G06F,H04L

Claim Text:
1. A method of vulnerability testing of a web application using external testing, wherein an external test system runs with permissions of a user of the web application and interacts with the web application over a network, the method comprising: obtaining a schedule for a vulnerability test, the schedule comprising a plurality of steps to be performed by the external test system to detect particular vulnerabilities of the web application, wherein at least some of the plurality of steps alter a state of the web application such that at least one later step would operate differently given the altered state; executing the schedule using the external test system; logging at least portions of responses of the web application to interactions of the external test system with the web application; comparing portions of the responses to expected possible responses associated with particular possible vulnerabilities of the web application, thereby detecting possible vulnerabilities of the web application; and for at least one detected possible vulnerability, generating a reconstruction script that comprises at least instructions to place the web application, before attempting to eliminate the at least one detected possible vulnerability, in a state at least similar to the state at which the at least one detected possible vulnerability was detected during execution of the schedule and that comprises at least instructions to interact with the web application in an attempt to recreate the detection of the at least one detected possible vulnerability without requiring reexecution of the schedule so as to facilitate the process of eliminating the at least one detected possible vulnerability, wherein the detected possible vulnerability is a set of tests matching a certain criteria and wherein the certain criteria include a given site, a given path, and a given class of vulnerability.