Patent ID: 7975296
Filing Date: 2011-07-05
Classification: G06F,H04L

Abstract:
1. A method of security testing a web application comprising: identifying a web application to be tested; generating one or more functional test scripts that are configured to access the web application and to simulate user interaction with the web application; executing the one or more functional test scripts on the web application and storing responses from the web application; identifying potential security vulnerabilities of the web application based at least in part on the stored responses, wherein said potential security vulnerabilities include session management vulnerability, and authentication/access control vulnerability; generating at least one security test script based at least in part from the functional test scripts, where the security test script tests said potential vulnerabilities; executing said security test script on said web application; logging session identifiers obtained during the execution of the security test script and determining whether the session identifiers are secure; analyzing results of said executing said security test script; and using the results of said executing said security test script to modify and provide increased security of said web application.