Hewlett-packard Development Company, L.P.

Raymond Kelly

Caleb Sima

William Matthew Hoffman

Steve Alan Millar

Bryan Sullivan

Gerald Eugene Sullivan

David Tillery

A web application is more efficiently analyzed by intelligently generating attack sequences to be used in the assessment. Rather than simply sending a canned list of static strings at a web application, the operation of the web application is analyzed to determine the filtering and acceptance characteristics of the web site. As this information is ascertained, a vocabulary of allowed symbols is created. This vocabulary is used in the building of attack strings and as such, the number of attack strings fired at the web application is greatly reduced, as well as the number of false positives.

Web application assessment based on intelligent generation of attack strings

A vulnerability assessment tool that is operative to analyze web sites by simultaneously operating a crawling process and an audit process. Once the crawling process is invoked, the results are provided to the audit process. The audit process, rather than waiting until the crawl process is completed, simultaneously audits the web site based on the already provided crawl results. The results of the audit are also fed back to the crawl process to further enhance the crawl.

Integrated crawling and auditing of web applications and web content

Growing community of inventors

Loganville, GA, United States of America

Raymond Kelly