Ask Patents is a question and answer site for people interested in improving and participating in the patent system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a professional pentester and generally conduct a lot of webapplication assessments where we use the described techniques for detecting vulnerabilities. These techniques are not new and the patent basically describes the general approach every pentester uses to assess their web applications.

In my eyes the patent granted is a bit like as if someone suddenly would take a patent on writing words to a piece of paper with pen using the latin alphabet. It does not make sense to me that this exists and was granted in the first place.

I wonder what this patent effetively means for all security professionals performing security assessments on Web Applications (or creators of automated tools such as Portswigger's Burp or OWASP's Zed Attack Proxy (ZAP)). Are we to be worried that IBM can start demanding money for creating automated tools using these techniques or even from consultants?

Claim 1

  1. A system comprising: a black-box tester comprising a hardware processor configured to interact with a web application during its execution to identify a web page exposed by the web application, the web application being hosted by a server and accessible by a client computer; a constraint manager configured to: receive the web page identified by the black-box tester; statically analyze the web page to identify a hidden parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application, the hidden parameter to indicate an authorization level of a user of the client computer; and determine a server-side validation measure to be applied to the hidden parameter comprising the web application checking for a correlation between a value of the hidden parameter and a value of at least one other parameter from the user; and a static analyzer configured to: statically analyze the web application to identify a location within the web application where the hidden parameter is input into the web application; query the constraint manager for the server-side validation measure to be applied to the hidden parameter; determine whether the web application checks for the correlation between the value of the hidden parameter and the value of the least one other client-supplied parameter according to the server-side validation measure from the constraint manager prior to the hidden parameter being used in a security-sensitive operation; and identify the hidden parameter as a security vulnerability where the web application does not check for the correlation between the value of the hidden parameter and the value of the at least one other client-supplied parameter prior to the hidden parameter being used in the security-sensitive operation.
  2. The system of claim 1 wherein the static analyzer is further configured to statically analyze the web application by building a control-flow model and a data-flow model of the web application.
share|improve this question
“These techniques are not new” is absolutely key. Can you find a description of a technique that dates back from before 2011-06-30 (the filing date)? It doesn't have to have been implemented, just described, and the description doesn't have to be available for free, just available outside one organization (e.g. written in a book). The description does have to precisely match one of the claims (not the title, it's the claims that matter). – Gilles Jun 19 '14 at 13:01
Yea, that would be the OWASP testing guide v1 until 3 – Lucas Kauffman Jun 19 '14 at 14:54
Can you post that as an answer with a link? Then you can get upvoted. – Elin Jun 20 '14 at 10:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.