Patent ID: 8621639

Claim:
A method of testing a web application, the method comprising: communicating a first target request to the web application, the first target request being directed at the web application and being a request to be tested; receiving a first target response in response to the first target request wherein an attribute of the first target response is an indication of whether the first target response represents a resource or absence of access to the resource; identifying parameters from the web application while logged in as a user; communicating a second target request to the web application, the second target request being directed at the web application and determined based on the first target request or the first target response; receiving a second target response in response to the second target request, the second target response being a predetermined target response known to generate a response indicative of an error of the web application; comparing the first target response to the second target response to determine the attribute of the first target response using a classification-based matching process; and determining whether or not the web application has one or more vulnerabilities based on the attribute of the first target response.