Google Inc.

Sebastian Lekies

Claudio Criscione

David Aslanian

Nicolas Golubovic

Jean-Baptiste Cid

Joseph A Nelson

A method includes receiving a scan request requesting to scan a set of network-connected assets designated for a network scan. For each respective network-connected asset, the method includes scanning, at a network security scanner using a first scanning privilege level, the respective network-connected asset. The method includes determining, based on the scan using the first scanning privilege level, whether the respective network-connected asset has a vulnerability. In response, the method includes scanning, at the network security scanner using a second scanning privilege level, the respective network-connected asset. The second scanning privilege level defines a lower level of access the network security scanner has than the first scanning privilege level. The method includes determining, based on the scans, an exposure level of the vulnerability. The method includes reporting the exposure level of the vulnerability to a user of the respective network-connected asset.

Determining the exposure level of vulnerabilities

A method for minimizing scan disruptions includes receiving a scan request requesting to scan a set of network-connected assets. Each network-connected asset is associated with corresponding network characteristics. The method includes partitioning the set of network-connected assets into a plurality of groups based on the corresponding network characteristics. For each respective group, simultaneously, the method includes determining an ordered list for scanning each network-connected asset in the respective group, scanning a first network-connected asset of the respective group based on the ordered list, and, after scanning the first network-connected asset, determining a post-scan health status of the first network-connected asset. The method includes determining, using the post-scan health status, that a health of the first network-connected asset is degraded. The method also includes, in response to determining that the health of the first network-connected asset is degraded, halting scanning of further network-connected assets in the respective group.

Minimizing security scanning induced network disruptions

A method for detecting an injection vulnerability of a client-side templating system includes receiving a web page, determining that the web page implements an interpreted programming language framework with client-side templating, and extracting a version of the interpreted programming language framework and an interpolation sign from the web page. The method also includes generating an attack payload for at least one injection vulnerability context of the web page based on the version of the interpreted programming language framework and the interpolation sign, instrumenting the web page to inject the attack payload into the at least one injection vulnerability context of the web page, and executing the instrumented web page.

Detecting injection vulnerabilities of client-side templating systems

This technology is directed to a rules based engine for managing network-based scanning of devices on a network to minimize disruptions to the network. One or more processors may identify an initial group of network devices from a set of network devices, the initial group of network devices being identified in accordance with a rule set, and initiate a scan of the initial group of network devices. The one or more processors may determine, in accordance with the rule set, an additional group of network devices from the set of network devices to be scanned and initiate a scan of the additional group of network devices. The steps may be repeated until all network devices in the set of network devices are scanned in accordance with the rule set.

Minimizing production disruption through a scan rule engine

A method () for detecting an injection vulnerability of a client-side templating system includes receiving a web page (), determining that the web page implements an interpreted programming language framework () with client-side templating, and extracting a version () of the interpreted programming language framework and an interpolation sign () from the web page. The method also includes generating an attack payload () for at least one injection vulnerability context () of the web page based on the version of the interpreted programming language framework and the interpolation sign, instrumenting the web page to inject the attack payload into the at least one injection vulnerability context of the web page, and executing the instrumented web page.

Growing community of inventors

Zurich, Switzerland

Sebastian Lekies