Rapid7, Inc.

Gerald Curran

Viliam Holub

Trevor Parsons

Systems and methods are disclosed for detecting code injection vulnerabilities in software systems. In embodiments, an injection string is created to implement an exploit against a software system. The exploit includes an unauthorized executable code that will generate an easily detectable token if executed by the software system. The string is injected into the software system during execution to simulate a code injection attack on the software system. The software system's execution result is obtained and analyzed to determine whether the execution detection token was generated. If so, the software system is proven to be vulnerable to the attack, and the vulnerability may be indicated in an alert or a report. The vulnerability detection technique may be for both software under development as well as production software systems running in the wild to analyze and monitor these systems for code injection vulnerabilities.

Growing community of inventors

Dublin, Ireland

Gerald Curran