Patent ID: 9213832
Filing Date: 2015-12-15
Classification: G06F,H04L

Abstract:
1. A system that dynamically scans a web application to perform a security analysis of the web application comprising: a computer-readable storage medium; and a processor configured to initiate executable operations comprising: collecting log file data from at least one log file, collecting the log file data comprising matching information from a previous HTTP request, which lead to a subsequent HTTP request being generated, using stateful parsing to identify information about at least one HTML parameter type by marking a certain parameter of the previous HTTP request as a parameter originating from a form or a hyperlink; entering data from the collected log file data into at least one data file; scanning the at least one data file to identify information relevant to security testing; from the identified information relevant to the security testing, generating at least a first HTTP request to exercise a web application to perform the security analysis of the web application, the first HTTP request corresponding to a second HTTP request generated by prior use or development of the web application and contained in the log file, the first HTTP request including form data that is different than form data contained in the second HTTP request and configured to specifically test for security vulnerabilities in the web application; communicating the HTTP request to the web application; receiving at least one HTTP response to the first HTTP request; analyzing the HTTP response to perform validation of the web application; and outputting results of the validation.