BASIC PRINCIPLES OF BUILDING BLACK-BOX VULNERABILITY SCANNER OF WEB RESOURCE

Abstract

The article discusses the main provisions for constructing a vulnerability scanner for a web resource based on the «black box» technique. The definitions of the Mealy automaton are introduced, applicable to the web application. An example of the use of the Mealy automaton for constructing transition graphs on the links of a web resource is given. An algorithm for constructing a graph based on sent requests and received answers is proposed. Describe the alleged problems that arise in the scanner. There are proposed ways of solving the problems obtained with the use of additional mechanisms and work algorithms. When the algorithm is running and transitions are added, the new vertex is colored with one of the colors, if a repeated state is detected. As a result, we have a colored graph, which may collapse in the same colors. The user in the browser moving inside the web application performs sequential actions, the scanning technique is as close as possible to the real actions of the average user and provides a top-down view of the content, as well as the probability of clicking on the link. Thus determined group of sequential requests that change the state of the scanner.