Automated dynamic security testing

A method, a system, and a computer program product for performing automated dynamic security testing. A generation of one or more requests is detected. The requests are generated by one or more user devices. A determination is made that the requests are associated with execution of a monitored software application. The determined requests are transmitted to one or more servers for executing a security scanning of the requests. The security scanning of the determined requests is executed to determine presence of one or more security threats associated with execution of the requests. A report of the execution of the security scanning is generated.

TECHNICAL FIELD

This disclosure relates generally to data processing and, in particular, to automated dynamic security testing of software applications.

BACKGROUND

Many companies rely on software systems, components, applications, etc. in conducting their daily activities. Examples of such software systems include email, word processing applications, internet browsing applications, financial software applications, sales applications, and/or many other types of software systems. Software is typically used by individuals to perform a variety of tasks and can involve vast amounts of data being generated, exchanged, manipulated, stored, etc. Ensuring that software applications do not contain threats, viruses, security vulnerabilities, etc. is important to continued operation of various processes, applications, etc.

SUMMARY

In some implementations, the current subject matter relates to a computer implemented method for performing automated dynamic security testing. The method may include detecting a generation of one or more requests, the requests being generated by one or more user devices, determining that the requests are associated with execution of a monitored software application, transmitting the determined requests to one or more servers for executing a security scanning of the requests, executing the security scanning of the determined requests to determine presence of one or more security threats associated with execution of the requests, and generating a report of the execution of the security scanning.

In some implementations, the current subject matter may include one or more of the following optional features. In some implementations, one or more plug-in components may be configured to perform the detecting of the generation of the one or more requests.

In some implementations, the requests may include a hypertext transfer protocol request and the monitored software application may be a web application.

In some implementations, the method may further include graphically displaying the generated report. The generated report may be displayed using a security portal communicatively coupled to the one or more servers.

In some implementations, the method may also include selecting a server to perform the executing of the security scanning of the determined requests to ascertain presence of one or more security threats associated with execution of the requests. At least one of the detecting, the determining, the transmitting, the executing, and the generating may be performed automatically.

DETAILED DESCRIPTION

One or more implementations of the current subject matter relate to methods, systems, articles of manufacture, and the like that may, among other possible advantages, provide an ability to automate dynamic security testing of software applications.

Conventional dynamic application security testing (DAST) tools typically include a software application that communicates with a web application to identify potential security vulnerabilities in the web application and architectural weaknesses. The DAST tool typically does not have access to a source code and thus, detects susceptibilities by actually performing attacks. The DAST tools detect weaknesses of the web application with minimal user interactions once configured with host name, crawling parameters and authentication credentials. The weakness are detected in query strings, headers, fragments, verbs (GET/POST/PUT) and DOM injections. Further, such web application scanners look for a wide variety of vulnerabilities, such as input/output validation, e.g. cross-site scripting and SQL injection, application problems, server configuration errors, etc.

FIG. 1illustrates an exemplary dynamic application security testing system100. The system100includes a user102(e.g., an individual, a software application, a software process, etc.), a browser104(e.g., FireFox browser, Internet Explorer browser, etc.), a server106(e.g., a BURP suite for testing security of software applications), and a web application108.

To perform dynamic application security testing, the user102submits a request (e.g., HTTP) to the browser104to access the web application108. The server106then performs security testing using the DAST tools. Some of the existing security testing tools implement a web crawler to “crawl” the web application108. This approach may be cumbersome for applications that include a large number of functions, workflows, etc., as security testing is performed function by function. Further, crawling can also take a substantial amount of time. Moreover, crawling the application does not provide any assurances that specific functions have been security testing, thereby potentially exposing users to security threats.

Other existing security testing tools involve manual capture of function requests using a security scanner. As shown inFIG. 1, the browser104may be configured to catch such function requests and the server106may be configured to perform appropriate security testing. However, this approach requires a substantial amount of expert knowledge of functions and is not scalable. Unfortunately, expert knowledge is not always available and might not cover all functions. Further, security expert knowledge may also be required to analyze any security test scan results and identify security threats.

In some implementations, the current subject matter provides a dynamic application security testing function coverage that allows automatic collection and testing of application requests. Such approach does not require expert knowledge of functions or time to perform security testing. In particular, the current subject matter system may include a security service portal for automating security scanning and testing as well as generation of a report that includes results of the scans/tests. In some implementations, the current subject matter may be configured to receive and scan the collected requests (e.g., HTTP) from an application browser (e.g., a web browser), distribute collected requests to a dynamic scan server for scanning/testing, and display a status of the scanning/testing processes as well as results of the scanning/testing. The report may be used to audit identified vulnerabilities and determine resolution. The current subject matter may also transmit notifications to users when the scanning/testing processes are started and completed (e.g., via a graphical user interface that may be provided in the user's system).

FIG. 2illustrates an exemplary system200for performing automated dynamic application security testing, according to some implementations of the current subject matter. The system200may include a user202(e.g., an individual user, a browser plug-in, a software application, an application process, an application plug-in, a computing system, etc.), a dynamic scan server204, a security portal206, and one or more applications, instances, etc. processes208. Components202-208may be communicatively coupled using one or more communications networks. The communications networks may include at least one of the following: a wired network, a wireless network, a metropolitan area network (“MAN”), a local area network (“LAN”), a wide area network (“WAN”), a virtual local area network (“VLAN”), an internet, an extranet, an intranet, and/or any other type of network and/or any combination thereof.

The components202-208may include any combination of hardware and/or software. In some implementations, components202-208may be disposed on one or more computing devices, such as, server(s), database(s), personal computer(s), laptop(s), cellular telephone(s), smartphone(s), tablet computer(s), and/or any other computing devices and/or any combination thereof. In some implementations, the components202-208may be disposed on a single computing device and/or can be part of a single communications network. Alternatively, the devices may be separately located from one another.

A user may access the system200via a user device202. The user device202may access and/or execute one or more software applications that may be deployed on the user device202. In some implementations, the user devices202may also include one or more application programming interfaces (APIs) that may be used for providing communication between the user devices202and other components204-208. Additionally, the user devices202may include one or more graphical user interfaces (e.g., for displaying results of the scan, etc.). The user devices202may also include one or more plug-ins and/or add-ins that may be used for providing communications, execution of various functions (e.g., collection of requests issued by the user), etc. between the user devices202and other components204-208.

As shown inFIG. 2, one or more users using devices202may access the system200. The users can be individual users, computing devices, software applications, objects, functions, and/or any other types of users and/or any combination thereof. The user device202may generate an instruction/command (e.g., a request) to access an application, which may be transmitted to the engine204to process the request. The instruction/command can be in a form of a query, a function call, and/or any other type of instruction/command. In alternate, implementations, the instructions/commands may be provided using a screen (e.g., using a touchscreen, a stylus pen, and/or in any other fashion), a keyboard, a mouse, a camera, a camcorder, a telephone, a smartphone, a tablet computer, a personal computer, a laptop computer, and/or using any other device. The user device202may generate the command automatically and/or manually. Based on the command, the server204may perform various functions associated with application security testing, as discussed below.

In some exemplary, non-limiting, implementations, the user device202may include a request collector (e.g., HTTP request) plug-in that may be installed in a user's browser (e.g., Firefox browser, an Internet Explorer browser, etc.). The plug-in may be configured to monitor and collect user-issued requests for transmission to the scan server204. The requests may be associated with various applications, instances, etc.208(e.g., credit card payment services, video hosting services, etc.) that the user desires to access. In some implementations, the plug-in may be a web extension for collecting HTTP requests and uploading collected requests to the dynamic scan server204for performing dynamic scans. Moreover, scan domain and/or blacklist type (e.g., requests, function calls, etc. identified as security threats) may be specifically configured using the plug-in.

FIG. 3aillustrates an exemplary graphical user interface300associated with the plug-in. The interface300may include an indication of a number of requests collected by the plug-in (e.g., “2 collected”). The requests may be transmitted to the server204for scanning.

The server204may use any means to obtain appropriate data/information for the purposes of application security testing. These means may include any means that may include at least one of the following: a query, a function call, a command, a graphical command (e.g., using a touchscreen, a stylus pen, and/or in any other fashion), a text command (e.g., using a keyboard, a mouse, a smartphone, a tablet computer, a personal computer, a laptop computer, and/or using any other device), and/or any other means. The server204may also be communicatively coupled to various public and/or private databases and/or servers that may store various information that may be useful for the purposes of performing application security testing.

In some implementations, the server204may be a centralized server that may be configured to receive collected requests from the plug-in and perform scanning of the collected requests using a backend scanner tool. Another exemplary plug-in interface310is shown inFIG. 3b. The plug-in may be installed in a browser interface and may indicate a number of collected requests (e.g., as shown inFIG. 3b, 30 requests were collected).

The security portal206may be configured to display results of the scanning process. The report may include identification of various vulnerabilities and/or security threats.FIG. 3cillustrates an exemplary report320that shows that various threats/vulnerabilities have been identified. In particular, as shown in the report320, two threats were identified (ID no.85and86) relating to cross-scripting processes. The report may also indicate specific severity, module, and status of each of the identified threats. Selecting one of the threats, further information may also be displayed, e.g., hashID, Flaw Link, Issue Name, and URL.

FIG. 4aillustrates an exemplary system400for performing automated dynamic application security testing, according to some implementations of the current subject matter. The system400may include a user402(e.g., an individual user, a browser plug-in, a software application, an application process, an application plug-in, a computing system, etc.), a dynamic scan server404, a security portal406, one or more applications, instances, etc. processes408, and an automated execution portal410that includes an execution engine412. Similar toFIG. 2, components402-412may be communicatively coupled using one or more communications networks. The communications networks may include at least one of the following: a wired network, a wireless network, a metropolitan area network (“MAN”), a local area network (“LAN”), a wide area network (“WAN”), a virtual local area network (“VLAN”), an internet, an extranet, an intranet, and/or any other type of network and/or any combination thereof. In some implementations, components402-412may include any combination of hardware and/or software. In some implementations, components402-412may be disposed on one or more computing devices, such as, server(s), database(s), personal computer(s), laptop(s), cellular telephone(s), smartphone(s), tablet computer(s), and/or any other computing devices and/or any combination thereof.

In some implementations, the automated execution portal410, along with the user device402, may be configured to execute various requests (e.g., HTTP requests) for applications408. By way of a non-limiting example, the automated execution portion410may include Selenium portable framework for testing web applications. Such portable framework may be used to configure and automate any scanning processes that may be performed by the dynamic scan server404. One or more virtual machines may be used for the purposes of execution of the scanning processes.

In some implementations, to enable automation of the scanning processes, the use device402may include a plug-in that may perform listening for requests. An example of such listener may include a testNG listener (e.g., an existing testing framework for simplifying various testing needs, e.g., unit testing (i.e., testing a class in isolation), integration testing (i.e., testing entire systems consisting of several classes, several packages, several external frameworks, application servers, etc.). The plugin may be loaded onto the user device's402browser and may automatically start collection of application requests once triggering automation processes by the execution engine412in the portal410. The plugin may also stop collection of requests and upload collected requests to dynamic scan server404once automation is stopped. The dynamic scan server404may include one or more scanning servers, where incoming requests may be distributed among such servers.

In some implementations, when the automation test is started, the testNG listener may notify the plugin by executing a script event (e.g., a javascript event). The plugin may be registered with an event handler to receive the execution of event and trigger an appropriate related action. The testNG listener may execute the script event (e.g., javascript event) at various stages, such as for example: onTestSuccess, onTestFailure, onTestSkipped, etc. An exemplary listener is illustrated in Appendix A.

FIG. 4billustrates an exemplary system420for performing automated dynamic application security testing, according to some implementations of the current subject matter. The system420may include a user422(e.g., an individual user, a browser plug-in, a software application, an application process, an application plug-in, a computing system, etc.), a security portal424, a dynamic scan server426, and one or more applications, instances, etc. processes432. The dynamic scan server426may further include a job scheduler428and a scanner430(e.g., a Burp scanner (e.g., a Java process)). Once the collected HTTP requests are uploaded to the security portal424, a new job may be queued on the dynamic scan server426using known job scheduling frameworks428(e.g., resque). In some implementations, a number of worker nodes may be implemented on the dynamic scan server426to process various jobs from the queue. When a job is executed, a backend scanner430may be invoked to process one or more security test(s) against collected HTTP requests. In some exemplary implementations, the backend scanner430may be an extended version of a Burp Scanner, which may be configured to fully automating login, CSRF token replacement, cookie(s) update, etc.

FIG. 5illustrates an exemplary process500for performing automated dynamic application security testing, according to some implementations of the current subject matter. The process500may be performed by one or more components of the system400shown inFIG. 4a(or the system420shown inFIG. 4b). Referring back toFIG. 5(andFIG. 4a; similar description will be applicable toFIG. 4b), at502, the automated execution portal410may be initiated. The processes performed by the engine412of the portal410may be initiated upon receiving a request from the user device402directed to the application408. The request may be an HTTP request, a query, an opening of a particular user interface, accessing an application icon on the user's device, and/or by any other means. The user device402may include a plug-in component that may be configured to detect user's action and transmit a trigger to the automated execution portal410to initiate its operation.

At504, the application testing process may be initiated. In some exemplary non-limiting implementations, various Selenium testing framework's processes may be executed for the purposes of testing one or more processes of the application408that the user device wishes to access. In some implementations, the dynamic scan server404may be configured to receive a trigger indicating that requests may be transmitted to it for scanning/testing purposes.

At506, the plug-in installed (e.g., testNG plugin) on the user device402may be configured to monitor user's actions to determine whether requests generated by the user device402may need to be collected for the testing/scanning by the server404. If the request are not to be collected, the plug-in may terminate any collection processes, at508.

If the requests are to be collected, the plug-in at the user device402may be configured to collect the requests, at510. The collected requests may be stored in memory of the device402that may be specifically allocated for that purpose. In some implementations, the collected requests may be grouped by processes, applications, user, and/or in any other desired ways for storage.

At512, the collected requests may be transmitted and/or uploaded to the dynamic scan server404. In some implementations, the uploaded requests may be stored in the server's memory and, once scanned/tested, may be deleted/purged in order to make the memory available for future requests.

In some implementations, the process500may determine whether the server404is available for scanning/testing purposes, at514. If the server404is not available, the process500may be configured to await availability of the server404, at516. Once the server404becomes available, the server404may perform a scan/test of the uploaded requests, at518. Upon completion of the scan, the server404may generate and transmit a report. The report may indicate whether all scanned/tested requests are clear (i.e., no vulnerabilities, threats, etc. are found), whether vulnerabilities/threats are found and/or whether what, if any, actions may be taken to address such vulnerabilities/threats. The report may be displayed in the security portal406, at520.

As shown inFIG. 4b, the dynamic scan server426may include the job scheduler server428to process the jobs scheduled through security portal424. The security portal424may be a web portal that may provide a user interface for reviewing of the report identifying any threats/vulnerabilities. User(s) may access the portal through any user device (e.g., a browser, a mobile device, etc.).

In some implementations, the current subject matter may be implemented in various in-memory database systems, such as a High Performance Analytic Appliance (“HANA”) system as developed by SAP SE, Walldorf, Germany. Various systems, such as, enterprise resource planning (“ERP”) system, supply chain management system (“SCM”) system, supplier relationship management (“SRM”) system, customer relationship management (“CRM”) system, and/or others, may interact with the in-memory system for the purposes of accessing data, for example. Other systems and/or combinations of systems may be used for implementations of the current subject matter. The following is a discussion of an exemplary in-memory system.

FIG. 6illustrates an exemplary system600in which a computing system602, which may include one or more programmable processors that may be collocated, linked over one or more networks, etc., executes one or more modules, software components, or the like of a data storage application604, according to some implementations of the current subject matter. The data storage application604may include one or more of a database, an enterprise resource program, a distributed storage system (e.g. NetApp Filer available from NetApp of Sunnyvale, Calif.), or the like.

The one or more modules, software components, or the like may be accessible to local users of the computing system602as well as to remote users accessing the computing system602from one or more client machines606over a network connection610. One or more user interface screens produced by the one or more first modules may be displayed to a user, either via a local display or via a display associated with one of the client machines606. Data units of the data storage application604may be transiently stored in a persistence layer612(e.g., a page buffer or other type of temporary persistency layer), which may write the data, in the form of storage pages, to one or more storages614, for example via an input/output component616. The one or more storages614may include one or more physical storage media or devices (e.g. hard disk drives, persistent flash memory, random access memory, optical media, magnetic media, and the like) configured for writing data for longer term storage. It should be noted that the storage614and the input/output component616may be included in the computing system602despite their being shown as external to the computing system602inFIG. 6.

Data retained at the longer term storage614may be organized in pages, each of which has allocated to it a defined amount of storage space. In some implementations, the amount of storage space allocated to each page may be constant and fixed. However, other implementations in which the amount of storage space allocated to each page may vary are also within the scope of the current subject matter.

FIG. 7illustrates exemplary software architecture700, according to some implementations of the current subject matter. A data storage application604, which may be implemented in one or more of hardware and software, may include one or more of a database application, a network-attached storage system, or the like. According to at least some implementations of the current subject matter, such a data storage application604may include or otherwise interface with a persistence layer612or other type of memory buffer, for example via a persistence interface702. A page buffer704within the persistence layer612may store one or more logical pages706, and optionally may include shadow pages, active pages, and the like. The logical pages706retained in the persistence layer612may be written to a storage (e.g. a longer term storage, etc.)614via an input/output component616, which may be a software module, a sub-system implemented in one or more of software and hardware, or the like. The storage614may include one or more data volumes710where stored pages712are allocated at physical memory blocks.

In some implementations, the data storage application604may include or be otherwise in communication with a page manager714and/or a savepoint manager716. The page manager714may communicate with a page management module720at the persistence layer612that may include a free block manager722that monitors page status information724, for example the status of physical pages within the storage614and logical pages in the persistence layer612(and optionally in the page buffer704). The savepoint manager716may communicate with a savepoint coordinator726at the persistence layer612to handle savepoints, which are used to create a consistent persistent state of the database for restart after a possible crash.

In some implementations of a data storage application604, the page management module of the persistence layer612may implement a shadow paging. The free block manager722within the page management module720may maintain the status of physical pages. The page buffer704may include a fixed page status buffer that operates as discussed herein. A converter component740, which may be part of or in communication with the page management module720, may be responsible for mapping between logical and physical pages written to the storage614. The converter740may maintain the current mapping of logical pages to the corresponding physical pages in a converter table742. The converter740may maintain a current mapping of logical pages706to the corresponding physical pages in one or more converter tables742. When a logical page706is read from storage614, the storage page to be loaded may be looked up from the one or more converter tables742using the converter740. When a logical page is written to storage614the first time after a savepoint, a new free physical page is assigned to the logical page. The free block manager722marks the new physical page as “used” and the new mapping is stored in the one or more converter tables742.

The persistence layer612may ensure that changes made in the data storage application604are durable and that the data storage application604may be restored to a most recent committed state after a restart. Writing data to the storage614need not be synchronized with the end of the writing transaction. As such, uncommitted changes may be written to disk and committed changes may not yet be written to disk when a writing transaction is finished. After a system crash, changes made by transactions that were not finished may be rolled back. Changes occurring by already committed transactions should not be lost in this process. A logger component744may also be included to store the changes made to the data of the data storage application in a linear log. The logger component744may be used during recovery to replay operations since a last savepoint to ensure that all operations are applied to the data and that transactions with a logged “commit” record are committed before rolling back still-open transactions at the end of a recovery process.

With some data storage applications, writing data to a disk is not necessarily synchronized with the end of the writing transaction. Situations may occur in which uncommitted changes are written to disk and while, at the same time, committed changes are not yet written to disk when the writing transaction is finished. After a system crash, changes made by transactions that were not finished must be rolled back and changes by committed transaction must not be lost.

To ensure that committed changes are not lost, redo log information may be written by the logger component744whenever a change is made. This information may be written to disk at latest when the transaction ends. The log entries may be persisted in separate log volumes while normal data is written to data volumes. With a redo log, committed changes may be restored even if the corresponding data pages were not written to disk. For undoing uncommitted changes, the persistence layer612may use a combination of undo log entries (from one or more logs) and shadow paging.

The persistence interface702may handle read and write requests of stores (e.g., in-memory stores, etc.). The persistence interface702may also provide write methods for writing data both with logging and without logging. If the logged write operations are used, the persistence interface702invokes the logger744. In addition, the logger744provides an interface that allows stores (e.g., in-memory stores, etc.) to directly add log entries into a log queue. The logger interface also provides methods to request that log entries in the in-memory log queue are flushed to disk.

Log entries contain a log sequence number, the type of the log entry and the identifier of the transaction. Depending on the operation type additional information is logged by the logger744. For an entry of type “update”, for example, this would be the identification of the affected record and the after image of the modified data.

When the data application604is restarted, the log entries need to be processed. To speed up this process the redo log is not always processed from the beginning. Instead, as stated above, savepoints may be periodically performed that write all changes to disk that were made (e.g., in memory, etc.) since the last savepoint. When starting up the system, only the logs created after the last savepoint need to be processed. After the next backup operation the old log entries before the savepoint position may be removed.

When the logger744is invoked for writing log entries, it does not immediately write to disk. Instead it may put the log entries into a log queue in memory. The entries in the log queue may be written to disk at the latest when the corresponding transaction is finished (committed or aborted). To guarantee that the committed changes are not lost, the commit operation is not successfully finished before the corresponding log entries are flushed to disk. Writing log queue entries to disk may also be triggered by other events, for example when log queue pages are full or when a savepoint is performed.

With the current subject matter, the logger744may write a database log (or simply referred to herein as a “log”) sequentially into a memory buffer in natural order (e.g., sequential order, etc.). If several physical hard disks/storage devices are used to store log data, several log partitions may be defined. Thereafter, the logger744(which as stated above acts to generate and organize log data) may load-balance writing to log buffers over all available log partitions. In some cases, the load-balancing is according to a round-robin distributions scheme in which various writing operations are directed to log buffers in a sequential and continuous manner. With this arrangement, log buffers written to a single log segment of a particular partition of a multi-partition log are not consecutive. However, the log buffers may be reordered from log segments of all partitions during recovery to the proper order.

As stated above, the data storage application604may use shadow paging so that the savepoint manager716may write a transactionally-consistent savepoint. With such an arrangement, a data backup comprises a copy of all data pages contained in a particular savepoint, which was done as the first step of the data backup process. The current subject matter may be also applied to other types of data page storage.

In some implementations, the current subject matter may be configured to be implemented in a system800, as shown inFIG. 8. The system800may include a processor810, a memory820, a storage device830, and an input/output device840. Each of the components810,820,830and840may be interconnected using a system bus850. The processor810may be configured to process instructions for execution within the system800. In some implementations, the processor810may be a single-threaded processor. In alternate implementations, the processor810may be a multi-threaded processor. The processor810may be further configured to process instructions stored in the memory820or on the storage device830, including receiving or sending information through the input/output device840. The memory820may store information within the system800. In some implementations, the memory820may be a computer-readable medium. In alternate implementations, the memory820may be a volatile memory unit. In yet some implementations, the memory820may be a non-volatile memory unit. The storage device830may be capable of providing mass storage for the system800. In some implementations, the storage device830may be a computer-readable medium. In alternate implementations, the storage device830may be a floppy disk device, a hard disk device, an optical disk device, a tape device, non-volatile solid state memory, or any other type of storage device. The input/output device840may be configured to provide input/output operations for the system800. In some implementations, the input/output device840may include a keyboard and/or pointing device. In alternate implementations, the input/output device840may include a display unit for displaying graphical user interfaces.

FIG. 9illustrates an exemplary method900for performing automated dynamic security testing of software applications, according to some implementations of the current subject matter. At902, a generation of one or more requests may be detected. The requests may be generated by one or more user devices. At904, a determination may be made that one or more requests may be associated with execution of a monitored software application. At906, the determined requests may be transmitted to one or more servers for executing a security scanning of the requests. At908, security scanning of the determined requests may be performed to determine presence of one or more security threats associated with execution of the requests. At910, a report of the execution of the security scanning may be generated.

In some implementations, the current subject matter may include one or more of the following optional features. In some implementations, one or more plug-in components may be configured to perform the detecting of the generation of the one or more requests.

In some implementations, the requests may include a hypertext transfer protocol request and the monitored software application may be a web application.

In some implementations, the method may further include graphically displaying the generated report. The generated report may be displayed using a security portal communicatively coupled to the one or more servers.

In some implementations, the method may also include selecting a server to perform the executing of the security scanning of the determined requests to ascertain presence of one or more security threats associated with execution of the requests. At least one of the detecting, the determining, the transmitting, the executing, and the generating may be performed automatically.