Abstract: A method of verifying an application includes downloading source code for a first function exposed by the application and parsing the source code to determine an input object of the first function. The method also includes injecting a first fuzzing payload into the input object to generate a test object, invoking the first function using the test object, and determining whether the first function includes a vulnerability by analyzing a response to invoking the first function using the test object.

Abstract: A method of verifying an application includes downloading source code for a first function exposed by the application and parsing the source code to determine an input object of the first function. The method also includes injecting a first fuzzing payload into the input object to generate a test object, invoking the first function using the test object, and determining whether the first function includes a vulnerability by analyzing a response to invoking the first function using the test object.

Abstract: A method of verifying an application includes downloading source code for a first function exposed by the application and parsing the source code to determine an input object of the first function. The method also includes injecting a first fuzzing payload into the input object to generate a test object, invoking the first function using the test object, and determining whether the first function includes a vulnerability by analyzing a response to invoking the first function using the test object.

Abstract: A security system scans application programming interfaces (APIs) to detect security vulnerabilities by receiving API documentation from a third-party system associated with the API and organizing it in an API specification that describes the hostname of the API and one or more endpoints of the API. For each of the endpoints, the API specification includes a uniform resource identifier, a method term, an input content type, an output content type (if applicable), authorization details, and any associated parameters or arguments. The security system performs an audit job for each combination of endpoints, potential security vulnerabilities, and (in some embodiments) authentication flows. In some embodiments, the security system is able to access portions of the API requiring authentication by using authentication flows received from the third-party system and detect security vulnerabilities related to authentication by manipulating the authentication units that make up the authentication flow.

Abstract: A computer system records and recreates an interface navigation process performed by a user with a host system. The computer system observes the user's interactions with the various UI elements during an interface navigation process by using a browser extension for the browser application in which the user is performing the interface navigation process. The browser extension then stores information about the interactions the user is performing and the UI elements that they are being performed on. The browser extension sends the stored interactions to the computer system, which processes the interactions to generate steps of the interface navigation recording. In some embodiments, the computer system also identifies one or more UI elements present in the final UI state of the interface navigation process as “verifiers” that can be used to determine whether the recreation of the interface navigation process is successful.

Abstract: A computer system records and recreates an interface navigation process performed by a user with a host system. The computer system observes the user's interactions with the various UI elements during an interface navigation process by using a browser extension for the browser application in which the user is performing the interface navigation process. The browser extension then stores information about the interactions the user is performing and the UI elements that they are being performed on. The browser extension sends the stored interactions to the computer system, which processes the interactions to generate steps of the interface navigation recording. In some embodiments, the computer system also identifies one or more UI elements present in the final UI state of the interface navigation process as “verifiers” that can be used to determine whether the recreation of the interface navigation process is successful.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized individually and by various patterns evident in the received data, enabling further identification of component implementation aspects, such as revision levels. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data. This audit data is then available for reporting.

Abstract: A security system scans application programming interfaces (APIs) to detect security vulnerabilities by receiving API documentation from a third-party system associated with the API and organizing it in an API specification that describes the hostname of the API and one or more endpoints of the API. For each of the endpoints, the API specification includes a uniform resource identifier, a method term, an input content type, an output content type (if applicable), authorization details, and any associated parameters or arguments. The security system performs an audit job for each combination of endpoints, potential security vulnerabilities, and (in some embodiments) authentication flows. In some embodiments, the security system is able to access portions of the API requiring authentication by using authentication flows received from the third-party system and detect security vulnerabilities related to authentication by manipulating the authentication units that make up the authentication flow.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized individually and by various patterns evident in the received data, enabling further identification of component implementation aspects, such as revision levels. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data. This audit data is then available for reporting.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized, enabling further identification of component implementation aspects. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized individually and by various patterns evident in the received data, enabling further identification of component implementation aspects, such as revision levels. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data. This audit data is then available for reporting.

Abstract: A security auditing computer system efficiently evaluates and reports security exposures in a target Web site hosted on a remote Web server system. The auditing system includes a crawler subsystem that constructs a first list of Web page identifiers representing the target Web site. An auditing subsystem selectively retrieves and audits Web pages based on a second list, based on the first. Retrieval is sub-selected dependent on a determined uniqueness of Web page identifiers relative to the second list. Auditing is further sub-selected dependent on a determined uniqueness of structural identifiers computed for each retrieved Web page, including structural identifiers of Web page components contained within a Web page. The computed structural identifiers are stored in correspondence with Web page identifiers and Web page component identifiers in the second list. A reporting system produces reports of security exposures identified through the auditing of Web pages and Web page components.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized individually and by various patterns evident in the received data, enabling further identification of component implementation aspects, such as revision levels. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data. This audit data is then available for reporting.

Abstract: In auditing a target Web site for security exposures, site specific remediation reports are generated to provide instructional data tailored to components of the Web server solution stack as determined by the auditing computer system. Stack and component identification is performed in a site independent manner based on an analysis of Web page data retrieved by the auditing computer system. Informational aspects of the received data are recognized individually and by various patterns evident in the received data, enabling further identification of component implementation aspects, such as revision levels. Based on the informational and implementation aspects, site, solution stack, and component specific security audit tests are executed against the target Web site. Audit identified security exposures are recorded in correspondence with site, solution stack, and component implementation specific remediation instruction data. This audit data is then available for reporting.

Abstract: A security auditing computer system efficiently evaluates and reports security exposures in a target Web site hosted on a remote Web server system. The auditing system includes a crawler subsystem that constructs a first list of Web page identifiers representing the target Web site. An auditing subsystem selectively retrieves and audits Web pages based on a second list, based on the first. Retrieval is sub-selected dependent on a determined uniqueness of Web page identifiers relative to the second list. Auditing is further sub-selected dependent on a determined uniqueness of structural identifiers computed for each retrieved Web page, including structural identifiers of Web page components contained within a Web page. The computed structural identifiers are stored in correspondence with Web page identifiers and Web page component identifiers in the second list. A reporting system produces reports of security exposures identified through the auditing of Web pages and Web page components.