Patent ID: 8601586

Claim:
A method for detecting vulnerabilities in a web application, comprising: obtaining a plurality of web requests directed to the web application, wherein each web request specifies a request field including a requested uniform request locator (URL) having a hostname and at least one parameter field, the at least one parameter field including a parameter and a parameter value corresponding to the parameter; determining, using a hardware computing device, an initial list of suspicious web requests of the plurality of web requests, by determining if the at least one parameter field in the requested URL of each of the plurality of web requests matches a known attack; generating a final list of suspicious web requests by filtering the initial list of suspicious web requests, the filtering including removing duplicate suspicious web requests; receiving a set of predetermined attack strings configured to test a range of vulnerabilities of the web application; and determining whether each of the suspicious web requests of the final list potentially exploits a vulnerability of the web application based on the set of predetermined attack strings, the determining including replaying each of the suspicious web requests of the final list using the predetermined attack strings and determining whether a script has been executed or a special character has been returned during the replay.