SALTY CLOUD, PBC — Department of Defense SBIR Phase I: AF191-004

Description

Our objective is to conduct a feasibility study and demonstrate Product-USAF Fit between Dorkbot, a Web Application Vulnerability (WAV) Search and Testing application that is proven at scale outside the DoD. We also intend to identify an initial USAF customer. Unauthorized data release is a significant cybersecurity problem across Civilian and DoD Networks including the USAF. WAV exploits remain the leading source of breached records with a handful of WAV types (SQLi, LFI/RFI, CSFR, XSS) accounting for the vast majority of breaches. Dorkbot is an autonomous program for WAV discovery and verification through keyword-based searches of indexed website cache and archives. Dorkbot is proven as an efficient and effective method to identify and verify WAVs at scale. During the past 24 months over 700 EDUs and almost 100 state/local agencies have subscribed to Dorkbot. Dorkbot has searched the cache of tens of millions of webpages, identified hundreds of thousands of putative vulnerabilities for testing, and successfully verified and reported over 30,000 WAVs. It is our hypothesis that Dorkbot can be readily adapted for USAF use to provide on-the-job cyber maintenance/operational training to effectively and efficiently identify and remediate/exploit WAVs at scale.