Peer To Patent

Home > Archived Applications > 20090119777 > Prior Art > Detail

Pre-Grant Publication Number: 20090119777

Method and system of determining vulnerability of web application

Please help the USPTO examine the application by evaluating the relevance of the publicly submitted prior art to the patent application. Peer To Patent forwards the Top 10 most relevant prior art submissions and their annotations to the USPTO.

Review this prior art and click on the thumbs up (or down) to indicate whether this submission should be forwarded to the USPTO.
If you login then you can add an annotation by typing in the box at the bottom of the screen to comment on the relevance of the prior art to the claims of the patent application.

Prior Art Detail

Annotations(0)

#518IBM Rational App Scan

Applies to Claims 1,10,11,13,14,15,16,17,18,19,2,20,3,4,5,6,7,8,9

Submitted by: Omkhar ArasaratnamLast updated: almost 4 years ago

0 thumbs up 0 thumbs down

Summary / Description

Summary / Description	IBM Rational App Scan uses a similar method when interrogating web applications and scanning for vulnerabilities. There is other prior art as well, what is described is achieved by all web application security scanners.

Basic Information

Type of Prior Art	Source Code

Name/Title	IBM Rational App Scan

Publication Date	September 1, 2004

Author	IBM

URL	http://www-01.ibm.com/software/...

System Type	Application Program

Printed Materials (Documentation, Manual, Training Guide, Literature, et cetera)	Yes

Online Source Code Repository	No

Online project documentation	No

Storage Media (Floppy disk, CD-ROM, Tape, et cetera)	No

Other	No

How to Locate the Evidence (e.g. Location of the System Documentation -- Product Manual, User Guide, or Training Guide)

URL for Software Repository

URL for Product Description

Licensing Model	Proprietary or Closed Source

Programming Language

Notes / To Do

Notes

Excerpt

Excerpt

IBM Rational App Scan is a web application vulnerability scanning program. It has employed this method of scanning for web vulnerabilities since it's inception. There is much other prior art in this field as well.

Relevance

Claims

A method of determining vulnerability of web application comprising:selecting a fixed parameter from parameters of a URL link extracted from a website;

determining whether vulnerability determination has been completed for the selected fixed parameter;

inserting an attack pattern for each attack type to an input value for the selected fixed parameter, when the vulnerability determination has not been completed; and

determining vulnerability of the selected fixed parameter by each attack type through an analysis of response to an input of URL link with the attack pattern inserted thereinto.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, further comprising extracting the URL link from a main webpage of the website, before the step of selecting the fixed parameter.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, wherein the fixed parameter is defined as the parameter positioned at the left of a parameter classification mark included in the URL link.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, wherein the attack pattern is extracted from a first database for storing the attack pattern by each attack type.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, wherein the attack pattern for each attack type is formed in type of characters.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, wherein the attack type includes at least one of SQL Injection, Blind SQL Injection and XSS (Cross-Site Scripting).

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, further comprising mapping the fixed parameter to URL address of the website by each attack type and generating the mapping result, when it is determined that the fixed parameter is vulnerable to a specific attack type.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, wherein the vulnerability of the selected fixed parameter is determined based on the comparison of pre-stored result pattern and HTTP response pattern to the input of URL link with the attack pattern inserted thereinto.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, further comprising storing information of the URL links for which vulnerability determination has been completed.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 1, further comprising generating a URL-link list through the use of the extracted URL link, wherein it is determined whether vulnerability determination has been completed for the fixed parameter included in the URL link recorded in the URL-link list.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The method according to Claim 10, wherein a URL list is recorded in the URL-link list only if the URL list and the URL links already recorded in the URL-link list have different fixed parameters.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

A system of determining vulnerability of web application comprising:a fixed parameter selecting unit to select a fixed parameter from parameters of URL link extracted from a website;

a redundancy determining unit to determine whether vulnerability determination has been completed for the selected fixed parameter;

an attack-pattern inserting unit to insert an attack pattern for each attack type to an input value for the fixed parameter, when the vulnerability determination has not been completed; and

a vulnerability determining unit to determine the vulnerability of the selected fixed parameter through an analysis of response to an input of URL link with the attack pattern inserted thereinto.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, further comprising a URL-link extracting unit to extract the URL link from a main webpage of the website to be determined, and to provide the extracted URL link to the fixed parameter selecting unit.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, wherein the fixed parameter selecting unit selects the parameter, positioned at the right of a parameter classification mark included in the URL link, as the fixed parameter.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, further comprising:a first database for storing the attack pattern by each attack type; and

a second database for storing information of the URL links which complete the process of determining the vulnerability,

wherein the attack-pattern inserting unit extracts the attack pattern from the first data, and inserts the extracted attack pattern into the input value for the fixed parameter selected.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, wherein the attack type includes at least one of SQL Injection, Blind SQL Injection and XSS (Cross-Site Scripting).

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, further comprising a determining-result generating unit to generate results of determining vulnerability by mapping the fixed parameter to URL address of the website by each attack type to which the corresponding fixed parameter is determined to be vulnerable, when the vulnerability determining unit determines that the fixed parameter is vulnerable to the specific attack type.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, wherein the vulnerability determining unit determines the vulnerability of the fixed parameter based on the comparison of pre-stored result pattern of determining the vulnerability and HTTP response pattern to the input of URL link with the attack pattern inserted thereinto.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

The system according to Claim 13, further comprising a URL-link list generating unit to generate a URL-link list to be determined on vulnerability through the use of the extracted URL link, wherein the redundancy determining unit determines whether the process of determining the vulnerability for the fixed parameter included in the URL link recorded in the URL-link list is completed.

Relevance

Standard method of analyzing webpages, employed by App Scan

Claim Chart

All

0 days left