Patent ID: 8484738

Claim:
A system for providing penetration testing of a target application, comprising: logic implemented via hardware logic circuitry configured to find at least one database injection vulnerability in said target application so as to gain access to data associated with said target application, wherein said target application contains at least one data entry point, and wherein finding said at least one database injection vulnerability includes using a set of predefined strings that contain at least one of a group consisting of different syntaxes, commands, meta characters and alphanumerical characters to populate each of said at least one data entry points of said target application and using a set of predefined answers associated to each predefined string; logic implemented via hardware logic circuitry, configured to confirm said at least one database injection vulnerability and determine if said target application can be compromised by using the set of predefined strings to answer questions about the database injection vulnerability including a database management system, syntax of an underlying database command and syntax to compromise said database injection vulnerability wherein the database management system, syntax of the underlying database command and syntax to compromise the database injection vulnerability are determined by answers provided by the target application matched against the set of predefined answers associated to each predefined string; and logic implemented via hardware logic circuitry configured to compromise and analyze said application by extracting or manipulating data from a database associated with said application.