Patent ID: 8631497
Filing Date: 2014-01-14
Classification: G06F,H04L

Abstract:
1. A method of detecting a vulnerability of a target system, comprising: submitting, by a computer system, an innocuous input to the target system, the innocuous input designed to be a non-operation; computing by the computer system a baseline latency, the baseline latency being a time difference between submitting the innocuous input and receiving a reply from the target system; determining by the computer system a set of two or more programming languages, wherein at least one of the set of two or more programming languages is not SQL; constructing by the computer system an input for each programming language in the set, the input consistent with an interpreter for each corresponding programming language, the input designed to increase latency before a corresponding output from the target system; submitting by the computer system the input for each of the set of two or more programming languages to the target system; recording by the computer system a first time at which each input is submitted to the target system; recording by the computer system a second time at which each output from the target system is received; computing by the computer system a blind latency, the blind latency being a time difference between the second time and the first time; and determining by the computer system that the target system is vulnerable if the difference between the blind latency and the baseline latency exceeds a threshold.