Determination and classification of defense measures in web applications

Techniques for determining classifications of defense measures as described herein. Security tokens are identified to be used to test defense measures of a web application. Combinations of security tokens are determined, wherein the combinations of security tokens are related to classifications of the defense measures. A combination is executed at an input point of the web application. Based on the output of the web application received in response to the executed combination, a classification for a defense measure of the web application is determined.

BACKGROUND

The present disclosure relates generally to security testing of web applications. More specifically, the techniques described herein include classifications of defense measures implemented in web applications.

SUMMARY

In one embodiment, a method for classification of defense measures of a web application is described herein. Security tokens are identified. The security tokens are used to test the defense measures of the web application. Combinations of the security tokens are determined, wherein the combinations are related to classifications of the defense measures. A combination of security tokens are executed at an input point of the web application, and the classifications for the defense measures are determined based on the out of the web application received in response to the executed combination.

DETAILED DESCRIPTION

The embodiments disclosed herein relate to techniques for determining and classifying defense measures implemented in web applications. Webpages may implement security measures to prevent malicious attacks to be carried out via malicious code entered into the web application. For example, defense measures may include regular expressions configured to parse a string and determine the existence of malicious code.

Testing of the defense measures is helpful to determine the effectiveness of a given defense measure, and in some cases may determine the type of defense measure implemented. Testing may include audits wherein possible security vulnerabilities are identified by executing strings at a given input point to determine whether the defense measures are successful. In some cases, defense measures may be discovered by executing common security tokens that, for example within a string, may elicit a given response if the defense measures are designed to restrict the security tokens. In many cases, defense measures are sophisticated enough such that a given combination of security tokens may be allowed, while other combinations of security tokens may be restricted. Further, a given restriction resulting from a given combination may indicate that a type, or a class, of defense measures is implemented in the web application. In the embodiments described herein, combinations of security tokens associated with a given classification may be executed at an input point of the web application. The resulting output may be used to determine whether a classification of defense measures is implemented in the web application.

FIG. 1is a block diagram of a computing system configured to determine classifications of defense measures of a web application. The computing system100may include a computing device101having a processor102, a storage device104comprising a non-transitory computer-readable medium, a memory device106, a display interface108communicatively coupled to a display device110. The computing device101may include a network interface114communicatively coupled to a remote device116via a network118. The storage device104may include a classification module112configured to determine classifications of defense measures of a web application. In embodiments, the web application is be accessed via the network and is hosted on the remote device116. In some embodiments, the display interface108may enable a user of the computing system101to view the web application, and/or view the results of the defense measure classifications. The display device110may be an external component to the computing device101, an integrated component of the computing device101, or any combination thereof.

The classification module112may be logic, at least partially comprising hardware logic. In embodiments, the classification module112may be implemented as instructions executable by a processing device, such as the processor102. The instructions may direct the processor102to identify security tokens to be used to test defense measures of a web application, and determine combinations of the security tokens that are related to classifications of the defense measures. The combinations may be executed at an input point of the web application and a classification may be determined for a defense measure of the web application based on an output of the web application received in response to the executed application.

The processor102may be a main processor that is adapted to execute the stored instructions. The processor102may be a single core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory unit106can include random access memory, read only memory, flash memory, or any other suitable memory systems. The main processor102may be connected through a system bus122to components including the memory106, the storage device104, and the display interface108.

The block diagram ofFIG. 1is not intended to indicate that the computing device101is to include all of the components shown inFIG. 1. Further, the computing device101may include any number of additional components not shown inFIG. 1, depending on the details of the specific implementation.

FIG. 2is a block diagram of a system for determining defense measures of a web application. As illustrated inFIG. 2, security tokens202,204are provided to an input point206of a web application208, as indicated by the arrow210. The security tokens202,204may be associated with a classification of defense measures. In embodiments, the combination of security tokens202,204used may be determined by the classification module112, as indicated by the arrows212. In embodiments, the combination of security tokens202,204, are randomly selected and the combination is provided to the classification module112to verify whether the combination is related to a classification of defense measures.

The combination of security tokens202,204, is executed at the input point206. The web application208may be configured to provide the combination of security tokens202,204, to a defense measure212, as indicated by the arrow214. The defense measure212may then provide a response216within the web application208, as indicated by the arrow218. The response216may be provided to the classification module112, as indicated by the arrow220, wherein the classification module112may classify the defense measure212based on the combination of security tokens202,204executed at the input point206and based on the response216received.

In embodiments, the defense measure212may be a regular expression configured to detect the presence of potentially malicious code entered in a string at the input point. The combination of security tokens202,204, may be input at the input point206as a string containing potentially malicious code. For example, security token202may be contain the characters “script” and the security token204may contain a left parenthesis character “(.” For example, a defense measure, such as a regular expression, may allow the characters “script” to be entered, but not when the characters “script” are followed by the left parenthesis character “(.” In this scenario, a string containing “script” followed by a left parenthesis may be identified as potentially malicious. This type of defense measure may be defined as a correlation constraint wherein one security token is not allowed when a second security token is found in the same string executed at the input point206. The classification module112may, therefore, classify the defense measure212to at least include a correlation constraint.

As another example, the defense measure212may include an offset constraint. In this scenario, the defense measure212may allow certain combinations of security tokens, such as the combination of security tokens202,204, as long as the security tokens are offset from one another by a given number of characters in the string. For example, the security token “(” may be allowed to follow the security token “script” as long as the two security tokens are offset from each other by a certain number of characters.

As described above, the classification module112may be useful in determining the types of defense measures implemented in at web application. In the embodiments described herein, the classification module112enables contextual classification of defense measures and a nuanced understanding of the defense measure based on the correlation between combinations of defense measures and known classification types.

FIG. 3is a process flow diagram illustrating mapping of security tokens to classifications. As illustrated inFIG. 3, the process300may initialize at302, wherein security tokens are initially mapped to Boolean values as an empty map. A first available payload, including one or more security tokens, may be identified at304. At block306, it is determined whether there is a security token within the first payload that satisfies a classification “C.” If there is a security token satisfying a classification C, then that security token is mapped to that classification at308. At310, the process300may ask whether there are more tokens within the first payload to evaluate, and if there are, then the process resumes as302. If there are not, the process300ends at312.

However, if the first payload does not contain a security token satisfying a given context, then process continues at314wherein the process300determines whether the defense measures have a vulnerability. A vulnerability may be discovered when a web application does not restrict a payload containing security tokens. If a vulnerability is discovered, then process300may terminate at312. Otherwise, the process300may identify combinations of security tokens within the first payload that may map to a given classification at316. If a combination of security tokens within the first payload maps to a given classification316, then the process300may proceed to terminate at312. If combinations do not map to a given classification at316, then a widening threshold may be applied at318. The widening threshold is to enable mapping of a combination of security tokens within a predetermined threshold for error. Once the widening threshold has been applied, the process may terminate at312.

The process300may be used to classify a defense measure without executing every security token combination related to the classification. For example, once a defense measure has been discovered to enforce a correlation constraint, additional combinations of security tokens that would be restricted by the correlation constraint may not be required to be executed. In some embodiments, the determination of whether a given constraint satisfies a given classification may be based on domain knowledge of experts in the field. In this scenario, the domain knowledge indicates when a given security token combination may be representative of an entire classification of defense measures.

FIG. 4is a block diagram illustrating a method of determining classifications of defense measures. The method400may begin at block402wherein security tokens are identified to be used to test defense measures of a web application. Combinations of security tokens are determined at404, wherein the combinations of security tokens are related to classifications of the defense measures. A combination is executed at an input point of the web application at block406. Based on the output of the web application received in response to the executed combination, a classification for a defense measure of the web application is determined at block408.

FIG. 5is a block diagram depicting an example of a tangible, non-transitory computer-readable medium that can be used to determine classifications of defense measures. The tangible, non-transitory, computer-readable medium500may be accessed by a processor502over a computer bus504. Furthermore, the tangible, non-transitory, computer-readable medium500may include computer-executable instructions to direct the processor502to perform the steps of the current method.

The various software components discussed herein may be stored on the tangible, non-transitory, computer-readable medium500, as indicated inFIG. 5. For example, a classification module506may be configured to identify security tokens to be used to test defense measures of a web application, and determine combinations of the security tokens that are related to classifications of the defense measures. The classification module may execute a combination of the security tokens at an input point of the web application, and determine a classification for a defense measure of the web application based on an output of the web application in response to the executed combination.