Patent ID: 8893282

Claim:
A method for analyzing security vulnerabilities in server-based applications, the method comprising: identifying a target server-based application to be analyzed for security vulnerabilities; identifying one or more client-side applications, at least one of which is written such that not all entry points to the target server-based application are determinable from a scan of application code of the at least one client-side application; executing the one or more client-side applications in a monitored environment at a client, wherein the monitored environment isolates at least a part of the one or more executed client-side applications from the target server-based application to be analyzed for security vulnerabilities; extracting path parameters and data parameters, using tools of the monitored environment, from the at least the part of the one or more executed client-side applications having been isolated, wherein extracting comprises simulating an execution process of a client-side application and capturing remote connection attempts to one or more of the servers, wherein the extracted path parameters and data parameters refer to server-based applications serving the one or more executed client-side applications, wherein at least one reference is to the target server-based application; modifying the path parameters or data parameters with user-defined data to generate test data; transmitting the test data to the target server-based application; and determining if any responses received in response to the test data are indicative of security vulnerabilities in the target server-based application being analyzed for security vulnerabilities.