公开(公告)号：US09223977B2

公开(公告)日：2015-12-29

申请号：US13447904

申请日：2012-04-16

申请人： Yair Amit ,  Yinnon A. Haviv ,  Daniel Kalman ,  Omer Tripp ,  Omri Weisman

发明人： Yair Amit ,  Yinnon A. Haviv ,  Daniel Kalman ,  Omer Tripp ,  Omri Weisman

IPC分类号： G06F21/55 ,  G06F21/56 ,  G06F21/52 ,  G06F21/57

CPC分类号： G06F21/566 ,  G06F21/52 ,  G06F21/577

摘要： Testing a Web-based application for security vulnerabilities. At least one client request including a payload having a unique identifier can be communicated to the Web-based application. Response HTML and an associated Document Object Model (DOM) object can be received from the Web-based application. Content corresponding to the payload can be identified in the DOM object via the unique identifier. A section of the DOM object including the payload can be identified as un-trusted.

摘要翻译： 测试基于Web的应用程序的安全漏洞。 包括具有唯一标识符的有效载荷的至少一个客户端请求可以被传送到基于Web的应用。 可以从基于Web的应用程序接收响应HTML和关联的文档对象模型（DOM）对象。 可以通过唯一标识符在DOM对象中识别与有效载荷相对应的内容。 包括有效载荷的DOM对象的一部分可以被识别为不可信。

公开(公告)号：US09124624B2

公开(公告)日：2015-09-01

申请号：US13440416

申请日：2012-04-05

申请人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

发明人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

IPC分类号： H04L29/06 ,  H04W12/12 ,  H04L29/08

CPC分类号： H04L63/1433 ,  H04L63/145 ,  H04L67/02 ,  H04W12/12

摘要： A method, computer program product, and system for detecting vulnerabilities in web applications is described. A method may comprise determining one or more values associated with a web application that flow to response data associated with the web application. The one or more values may be modifiable by unreliable input. The method may further comprise generating a representation of the response data associated with the web application. The method may additionally comprise determining one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.

摘要翻译： 描述了一种用于检测Web应用程序中的漏洞的方法，计算机程序产品和系统。 方法可以包括确定与web应用程序相关联的一个或多个值，其流向与web应用相关联的响应数据。 一个或多个值可能由不可靠的输入修改。 该方法还可以包括生成与web应用相关联的响应数据的表示。 该方法可以另外包括至少部分地基于流向与web应用相关联的响应数据的不可靠输入可修改的一个或多个值来确定响应数据的一个或多个潜在易受攻击的部分，以及 与Web应用程序相关联的响应数据。

公开(公告)号：US20130139266A1

公开(公告)日：2013-05-30

申请号：US13307780

申请日：2011-11-30

申请人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

发明人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

IPC分类号： G06F11/00

CPC分类号： H04L63/1433 ,  H04L63/145 ,  H04L67/02 ,  H04W12/12

摘要： A method, computer program product, and system for detecting vulnerabilities in web applications is described. A method may comprise determining one or more values associated with a web application that flow to response data associated with the web application. The one or more values may be modifiable by unreliable input. The method may further comprise generating a representation of the response data associated with the web application. The method may additionally comprise determining one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.

公开(公告)号：US20130139267A1

公开(公告)日：2013-05-30

申请号：US13440416

申请日：2012-04-05

申请人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

发明人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

IPC分类号： G06F21/00

CPC分类号： H04L63/1433 ,  H04L63/145 ,  H04L67/02 ,  H04W12/12

摘要： A method, computer program product, and system for detecting vulnerabilities in web applications is described. A method may comprise determining one or more values associated with a web application that flow to response data associated with the web application. The one or more values may be modifiable by unreliable input. The method may further comprise generating a representation of the response data associated with the web application. The method may additionally comprise determining one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.

摘要翻译： 描述了一种用于检测Web应用程序中的漏洞的方法，计算机程序产品和系统。 方法可以包括确定与web应用程序相关联的一个或多个值，其流向与web应用相关联的响应数据。 一个或多个值可能由不可靠的输入修改。 该方法还可以包括生成与web应用相关联的响应数据的表示。 该方法可以另外包括至少部分地基于流向与web应用相关联的响应数据的不可靠输入可修改的一个或多个值来确定响应数据的一个或多个潜在易受攻击的部分，以及 与Web应用程序相关联的响应数据。

公开(公告)号：US09032529B2

公开(公告)日：2015-05-12

申请号：US13307780

申请日：2011-11-30

申请人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

发明人： Yair Amit ,  Daniel Kalman ,  Omer Tripp

IPC分类号： H04L29/06 ,  H04L29/08 ,  H04W12/12

CPC分类号： H04L63/1433 ,  H04L63/145 ,  H04L67/02 ,  H04W12/12

摘要： A method, computer program product, and system for detecting vulnerabilities in web applications is described. A method may comprise determining one or more values associated with a web application that flow to response data associated with the web application. The one or more values may be modifiable by unreliable input. The method may further comprise generating a representation of the response data associated with the web application. The method may additionally comprise determining one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.

公开(公告)号：US08683596B2

公开(公告)日：2014-03-25

申请号：US13283989

申请日：2011-10-28

申请人： Yair Amit ,  Yinnon A. Haviv ,  Daniel Kalman ,  Omer Tripp ,  Omri Weisman

发明人： Yair Amit ,  Yinnon A. Haviv ,  Daniel Kalman ,  Omer Tripp ,  Omri Weisman

IPC分类号： G06F21/00

CPC分类号： G06F21/566 ,  G06F21/52 ,  G06F21/577

摘要： Testing a Web-based application for security vulnerabilities. At least one client request including a payload having a unique identifier can be communicated to the Web-based application. Response HTML and an associated Document Object Model (DOM) object can be received from the Web-based application. Content corresponding to the payload can be identified in the DOM object via the unique identifier. A section of the DOM object including the payload can be identified as un-trusted.

摘要翻译： 测试基于Web的应用程序的安全漏洞。 包括具有唯一标识符的有效载荷的至少一个客户端请求可以被传送到基于Web的应用。 可以从基于Web的应用程序接收响应HTML和关联的文档对象模型（DOM）对象。 可以通过唯一标识符在DOM对象中识别与有效载荷相对应的内容。 包括有效载荷的DOM对象的一部分可以被识别为不可信。

公开(公告)号：US10586049B2

公开(公告)日：2020-03-10

申请号：US13335439

申请日：2011-12-22

申请人： Yair Amit ,  Evgeny Beskrovny ,  Omer Tripp

发明人： Yair Amit ,  Evgeny Beskrovny ,  Omer Tripp

IPC分类号： H04L29/06 ,  G06F21/57 ,  H04L29/08 ,  G06F9/30 ,  G07B17/00 ,  H04W12/00

摘要： A system for detecting a vulnerability in a Web service can include a processor configured to initiate executable operations including determining whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service and, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.

公开(公告)号：US08949994B2

公开(公告)日：2015-02-03

申请号：US13421125

申请日：2012-03-15

申请人： Yair Amit ,  Omer Tripp

发明人： Yair Amit ,  Omer Tripp

IPC分类号： G06F21/00 ,  G06F21/56 ,  H04L29/06 ,  G06F21/51 ,  G06F21/57

CPC分类号： G06F21/563 ,  G06F21/51 ,  G06F21/566 ,  G06F21/577 ,  H04L63/1433 ,  H04L63/1466

摘要： A method, including storing a test payload to a persistent state of an application and performing a static analysis to identify a first code location in the application that retrieves the test payload, to identify a first path from an entry point to the first code location, and to identify a second path from the first code location to a second code location that executes a security sensitive operation using the retrieved data. A dynamic analysis is then performed to retrieve the test payload via the first path, and to convey the test payload to the second code location via the second path.

公开(公告)号：US20120311713A1

公开(公告)日：2012-12-06

申请号：US13421125

申请日：2012-03-15

申请人： Yair Amit ,  Omer Tripp

发明人： Yair Amit ,  Omer Tripp

IPC分类号： G06F21/00

CPC分类号： G06F21/563 ,  G06F21/51 ,  G06F21/566 ,  G06F21/577 ,  H04L63/1433 ,  H04L63/1466

摘要： A method, including storing a test payload to a persistent state of an application and performing a static analysis to identify a first code location in the application that retrieves the test payload, to identify a first path from an entry point to the first code location, and to identify a second path from the first code location to a second code location that executes a security sensitive operation using the retrieved data. A dynamic analysis is then performed to retrieve the test payload via the first path, and to convey the test payload to the second code location via the second path.

公开(公告)号：US09460291B2

公开(公告)日：2016-10-04

申请号：US13429993

申请日：2012-03-26

申请人： Yair Amit ,  Alexander Landa ,  Omer Tripp

发明人： Yair Amit ,  Alexander Landa ,  Omer Tripp

IPC分类号： G06F21/57 ,  H04L29/06

CPC分类号： H04L63/1433 ,  G06F21/577 ,  G06F2221/033 ,  H04L63/1441 ,  H04L63/1483

摘要： A method for detecting security vulnerabilities in web applications can include providing a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier, detecting the identifier within the payload received during an interaction with the web application subsequent to the first interaction, and determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.

摘要翻译： 用于检测web应用程序中的安全漏洞的方法可以包括在计算机服务器与网络应用程序的第一次交互期间向web应用程序提供有效载荷，其中有效载荷包括有效负载指令和标识符，检测在 在所述第一交互之后与所述web应用的交互，以及响应于在所述有效载荷内检测到所述标识符，确定所述有效载荷指令是否在执行所述有效载荷指令之前进行了安全检查。