Whitehat Security, Inc.

Ntt Security Appsec Solutions Inc.

Synopsys, Inc.

Eric Sheridan

Harry Papaxenopoulos

John Thomas Melton

Prabhuram Mohan

Joseph Feiman

Disclosed are systems, methods and computer readable mediums for intelligent and directed dynamic application security testing. The systems, methods and computer-readable mediums can be configured to receive an attack location and an attack type for a web-application, transmit the attack location and attack type to a ID-DAST platform, receive from the ID-DAST platform a payload, attack the web-application using the payload, and receive results of the attack.

Systems and methods of intelligent and directed dynamic application security testing

Methods, apparatus, and systems for traversing a representation of an application source code, such as an abstract syntax tree (AST), are disclosed. Steps for traversing the AST include specifying a plurality of runtime binding rules which are associated with one or more locations within the AST, beginning to traverse the AST, monitoring a history of the traverse, continuing to traverse the AST based on the history of the traverse, and updating the history of the traverse. Continuing to traverse the AST may include identifying a plurality of concrete implementations of a method invocation and traversing less than all of the concrete implementations based at least in part on the runtime binding rules, the concrete implementations being traversed being selected based on the history of the traverse.

Techniques for traversing representations of source code

Methods, apparatus, and systems for traversing a representation of an application source code are disclosed. Steps for traversing the representation include beginning to traverse the representation, monitoring a history of the traverse, and continuing to traverse the representation based on the history of the traverse. Continuing to traverse the representation may include identifying a plurality of concrete implementations of a method invocation and traversing less than all of the concrete implementations, the concrete implementations being traversed being selected based on the history of the traverse.

Techniques for performing auto-remediation on computer system vulnerabilities in source code utilizing local repositories are disclosed herein. An application source code representation is scanned to determine any security vulnerabilities and from those vulnerabilities, a set of security patch rules are generated that may be used to automatically remediate the vulnerabilities. One or more of the security patch rules is selected for verification and, once verified may be used to generate a security patch. The security patch may then be automatically applied to the source code representation to produce a patched representation of the application source code with the vulnerability at least partly remediated.

Auto-remediation workflow for computer security testing utilizing pre-existing security controls

Techniques for performing auto-remediation on computer system vulnerabilities in source code are disclosed herein. An application source code representation is scanned to determine any security vulnerabilities and from those vulnerabilities, a set of security patch rules are generated that may be used to automatically remediate the vulnerabilities. One or more of the security patch rules is selected for verification and, once verified may be used to generate a security patch. The security patch may then be automatically applied to the source code representation to produce a patched representation of the application source code with the vulnerability at least partly remediated.

Auto-remediation workflow for computer security testing

Methods, apparatus, and systems for characterizing vulnerabilities of an application source code are disclosed. Steps for characterizing vulnerabilities include traversing a representation of the application source code, generating a signature of a potential vulnerability of the application source code, and determining characteristics of the potential vulnerability based on a correlation between the generated signature of the potential vulnerability and previously stored signatures of potential vulnerabilities.

Techniques for correlating vulnerabilities across an evolving codebase

Techniques for performing position analysis on a representation of an application source code are disclosed herein. An application source code is scanned to produce a representation of the application source code, start locations within the representation are determined, corresponding stop locations within the representation are determined, and a set of data impact locations within the representation are determined. The set of data impact locations are then used in a dataflow analysis to determine a position of high control of the data within the representation.

Growing community of inventors

Summerfield, NC, United States of America

Eric Sheridan