Hewlett Packard Enterprise Development LP

Entit Software LLC

Iftach Ragoler

Philip Edward Hamer

Brian V Chess

Sean Patrick Fay

Russell Andrew Spitler

Sasi Siddharth Muthurajan

Prajakta Subbash Jagdale

Prajakta Subhash Jagdale

Prajakta Subbash Jagdate

Leonid Promyshlyansky Bensman

Disclosed herein are techniques for determining vulnerabilities in applications under testing. It is determined whether a first database instruction of an application enters information into a database and whether a second database instruction thereof obtains said information from the database. If the first database instruction enters the information in the database and the second database instruction obtains the information therefrom, it is determined whether the application is vulnerable to entry of malicious code via the database.

Determining application vulnerabilities

The present disclosure provides a system that includes a server hosting an application under test (AUT), an observer configured to monitor instructions executed by the AUT, and a computing device communicatively coupled to the AUT and the observer through a common communication channel. The computing device may be configured to send an application request to the AUT, wherein the application request is configured to expose a potential vulnerability of the AUT. The computing device may receive an application response from the AUT in accordance with the AUT's programming. The computing device may send a service request to the observer, and receive a service response from the observer that contains information corresponding to the instructions executed by the AUT due to the application request, information about the AUT, or information about a server hosting the AUT.

Application security testing

Growing community of inventors

Alpharetta, GA, United States of America

Iftach Ragoler