Scanning web vulnerabilities
- 1. 1 Scanning for Web Vulnerabilities By Hacking Spot
- 2. 2 • Precisely document what a tool class does and does not do • Inform users – Match the tool to a particular situation – Understand significance of tool results • Provide feedback to tool developers Purpose of Tool Evaluations
- 3. 3 • Select class of tool • Develop clear (testable) requirements – Tool functional specification aided by focus groups – Spec posted for public comment • Develop a measurement methodology – Develop reference datasets (test cases) – Document interpretation criteria Details of Tool Evaluations
- 4. 4 • Static Analysis Security Tools • Web Application Vulnerability Tools • Binary Analysis Tools • Web Services Tools • Network Scanner Tools Some Tools for specific application*
- 5. 5 • Firewall • Intrusion Detection/Prevention System • Virus Detection • Fuzzers • Web Proxy Honeypots • Blackbox Pen Tester Other Types of Software Assurance Security Tools *
- 6. 6 • Life Cycle Process (requirements, design, …) • Automation (manual, semi, automatic) • Approach (preclude, detect, mitigate, react, appraise) • Viewpoint (blackbox, whitebox (static, dynamic)) • Other (price, platform, languages, …) How to Classify Tools and Techniques
- 7. 7 The Rise of Web App Vulnerability 0 5 10 15 20 25 2000 2001 2002 2003 2004 2005 2006 Remote file inclusion SQL injection Cross-site scripting Top web app vulnerabilities as % of total vulnerabilities in NVD
- 8. 8 is software which communicates with a web application through the web front-end and identifies potential security weaknesses in the web application.* Web Application Security Scanner
- 9. 9 Web Application Architecture Database Server Client (Browser, Tool, etc.) HTTP Requests HTML, etc. Webapp Web Server
- 10. 10 - Client and Server Interaction - Distributed n-tiered architecture - Remote access - Heterogeneity - Content delivery via HTTP - Concurrency - Session management - Authentication and authorization Characteristics of Web Application
- 11. 11 - Limited to tools that examine software applications on the web. - Does not apply to tools that scan other artifacts, like requirements, byte-code, or binary code - Does not apply to database scanners - Does not apply to other system security tools, e.g., firewalls, anti-virus, gateways, routers, switches, intrusion detection system Scope – What types of tools does this spec NOT address?
- 12. 12 - Cross-Site Scripting (XSS) - Injection flaws - Authentication and access control weaknesses - Path manipulation - Improper Error Handling Some Vulnerabilities that Web Application Scanners Check
- 13. 13 - AppScan DE by Watchfire, Inc. (IBM) - WebInpect by SPI-Dynamics (HP) - Acunetix WVS by Acunetix - Hailstorm by Cenzic, Inc. - W3AF, Grabber, Paros, etc. - others… Some Web Application Security Scanning Tools
- 14. 14 • What is a common set of functions? • Can they be tested? • How can one measure the effectiveness? HackingSpot is “neutral”, not consumer reports, and does not endorse products. Establishing a Framework to Compare
- 15. 15 • Precisely document what a tool class does and does not do • Provide feedback to tool developers • Inform users • Match the tool to a particular situation • Understand significance of tool results Purpose of a Specification
- 16. 16 • Specifies basic (minimum) functionality • Defines features unambiguously • Represents a consensus on tool functions and requirements • Serves as a guide to measure the capability of tools How should this spec be viewed?
- 17. 17 • Not to prescribe the features and functions that all web application scanner tools must have. • Use of a tool that complies with this specification does not guarantee the application is free of vulnerabilities. • Production tools should have capabilities far beyond those indicated. • Used as the basis for developing test suites to measure how a tool meets these requirements. How should this spec be used?
- 18. 18 • Found in existing applications today • Recognized by tools today • Likelihood of exploit or attack is medium to high Criteria for selection of Web Application Vulnerabilities
- 19. 19 • OWASP Top Ten 2007 • WASC Threat Classification • CWE – 600+ weaknesses definition dictionary • CAPEC- 100+ attack patterns for known exploits Web Application Vulnerabilities
- 20. 20 • Test applications that model real security features and vulnerabilities • Configurable to be vulnerable to one or many types of attack • Ability to provide increasing level of defense for a vulnerability Test Suites
- 21. 21 Defense Mechanisms • Different programmers use different defenses • Defenses/Filters are not all equivalent • We have different instances of vulnerabilities: levels of defense
- 22. 22 • Example: Cross-Site Request Forgeries Levels of Defense Untrusted.c0m MyShopping.Com CSRF ScriptUntrusted.c0m redirects to MyShopping.Com GET /shop.aspx?ItemID=42&Accept=Yes Thanks For Buying This Item! “This nice new website: Untrusted.c0m”
- 23. 23 • Example: Cross-Site Request Forgeries - Level 0: No Protection (bad) - Level 1: Using only POST (well...) - Level 2: Checking the referrer (better but referrer may be spoofed) - Level 3: Using a nonce (good) • Higher level means harder to break Levels of Defense
- 24. 24 Web Server Database Server Web Application Scanner Tool Attacks HTML, etc. Webapp Tool Report Seeded Vulns. Cheat sheet ?
- 25. 25 Attacks Analysis • An action that exploits a vulnerability • What exactly is the tool testing? • What do I need to test in my application? • Do the results match?
- 26. 26 Web Server Database Server Web Application Scanner Tool Attacks HTML, etc. Webapp Tool Report Attacks Analysis Seeded Vulns.?
- 27. 27 • Test Suite with 21 vulnerabilities (XSS, SQL Injection, File Inclusion) – PHP, MySQL, Ajax – LAMP • 4 Scanners (Commercial and Open Source) • One type of vulnerability at the time • Results (Detection rate, False-Positive rate) Test Suite Evaluation
- 28. 28 • Tools are limited in scope (companies sell service as opposed to selling tool) • Speed versus Depth (in-depth testing takes time) • Difficult to read output reports (typically log files) • False-Positives • Tuning versus default mode Issues with Web Application Scanner Tools
- 29. Thank You 29