## THE ONLY FALSE POSITIVE FREE WEB APPLICATION SECURITY AND VULNERABILITY SCANNER * * * Almost every business entity on the market today is trying hard to stretch out this year’s budget and somehow fit ‘security’ in the environment. Preferably, with minimal cost. Business owners, board directors, stock holders and managers have all heard about those scary security breaches and security threats that can sink big multinational companies faster than torpedoes. Treacherous waters of our rough Internet sea are hiding many monsters in their depths, with names that to upper management sound more like Latin phrases form some distant biology class. Omnipresent threat from this vaguely defined danger is constantly being fueled by daily leaks, hacks and other fear-mongering media reports. In this highly volatile and rapidly changing ecosystem automated web application security tools are becoming more and more… appealing. Automated tools, with low incremental implementation cost, relatively high vulnerability detection percentage, scalable, integrable and with the ability to perform repetitive tasks very well, are usually obvious and logical choice for majority of small and medium-sized companies. All other alternatives would mean huge increase in initial investment – which is usually deemed as unnecessary cost. It is, therefore understandable why companies of all sizes are trying so hard to find some sort of magic bullet for all of their security problems. A solution that will keep them and their customers secure for years to come. They’ll just buy this or that and they’ll get their security back. This can be, and usually is a critical step in a lifetime of a company – and it can be a make or break type of a difference. Getting a wrong solution for your company can add additional cost down the line, if you ever have to reverse or change your decision. Companies often get ‘stuck’ with a solution that doesn’t satisfy initial or in some cases, future requirements. In difference to rapid application development, there’s simply no rapid security solution out there in the big blue. Small and medium-sized companies seem to be more ‘vulnerable’ and willing to ‘blind-jumps’ than their enterprise counterparts but to be fair, those companies also recover much faster. Many decisions companies make in this regard are heavily influenced by aggressive promotional presentations that are pushing for this or that particular solution to stay/become compliant with [ie] PCI DSS requirements. After all, It would be much more expensive to recover from a hack that to protect protect your network, right ? 😉 Better safe than sorry. ### What Are Web Application Security Scanners A web application security scanner is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses. It performs a black-box test. Unlike source code scanners, web application scanners don’t have access to the source code and therefore detect vulnerabilities by actually performing attacks. It facilitates the automated review of a web application with the expressed purpose of discovering security vulnerabilities, and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, such as input/output validation, specific application problems and server configuration mistakes. They simulate a malicious user by attacking and probing applications in attempt to identify results that are not part of the expected result set. With more and more business moving to continuous integration models, security will have to follow – and follow fast. Automated application security testing tools are being used more and more to detect vulnerabilities as fast as possible. However, automated solutions are far from perfect. There are so many vulnerabilities that are impossible for automated software to detect – like complex information leakage, race conditions, logic flaws, design flaws, multistage process attacks, etc. There are also many other types of vulnerabilities that are too complex or obscure to practically detect with an automated tool. Security testing is usually ( and unfortunately ) performed at the end of the SDLC. Most likely packed with user acceptance testing. In some cases security is even performed by external security testing team ! This ‘Testing section’ of SDLC is usually a place where you can find these automated tools. Good or bad, automated tools will be generally used in this stage with greater or lower success rate, depending on the tool, testers abilities and project timeline. This approach however, has a number of serious disadvantages. From the business side, the cost of addressing issues identified in the testing phases after the development is very high – compared to fixing security problems in the development phase. And, from code perspective it means that the people with the best understanding of the code are not involved in testing. Even in Agile, security is usually absent from the list of things to test. Developers tend to focus on meeting the functional requirements as fast as possible without paying much attention to security requirements. These problems cascaded into an ecosystem where the vast majority of web applications today are vulnerable to one or more web application attack. As web applications become more complex and with increased use of more sensitive data like personal, medical and financial information, it becomes increasingly evident that a new approach is needed. A model with better security and security testing procedures. To these days there are two primary methods for discovering web application vulnerabilities: using manual security testing and code review or using automated scanning tools and static analysis. Web application vulnerabilities can be generally grouped into two categories: technical and logical. * ** Technical vulnerabilities ** include cross-site scripting (XSS), injection flaws, buffer overflows…. There are more than 50 techniques that can be used to exploit XSS, one of the most common technical vulnerabilities. A typical registration form on the Web contains approximately 30 unique elements, each of which is potentially vulnerable to XSS, injection flaws, buffer overflows or improper error handling. Therefore, to test the form for XSS vulnerability, you would need more than 1500 tests to check all 30 elements against the 50 XSS techniques. It’s certainly no surprise that a great number of applications are vulnerable to this one exploit. Given the number of tests needed to check such applications for technical vulnerabilities, automated tools that are able to traverse, analyze and test are perhaps more efficient than manual penetration testing. Automated scanning and testing tools may not currently be able to test 100 percent of technical vulnerabilities, but they can test for a large percentage of them. * ** Logical vulnerabilities ** on the other hand are much harder to explicitly categorize. These vulnerabilities manipulate the logic of the application to get it to do things it was never intended to do. Logical vulnerabilities are security gaps that can be exploited by understanding how an application works and circumventing the typical business flow. While automated scanning tools can navigate a Web application, only security tester can understand the logic behind the application’s workflow. This understanding enables the tester to subvert the business logic and expose a security vulnerability. Neither manual security testing nor automated security scanning is an exhaustive method for identifying web application vulnerabilities. Each method has its own inherent strengths and weaknesses, and both can be used to discover critical security vulnerabilities in web applications. Automated tools were never intended to, and should never entirely replace manual security test. However, if used correctly, automated tools can be usd to find a broad range of technical security vulnerabilities in web applications, saving time and money. Sophisticated organizations will determine the correct mix of automated scanning versus manual penetration testing to provide the best Web application security coverage possible. ### How Web Application Security Scanners Work Web Application Security Scanner will crawl the target website or web application and identify all possible attack entry points and parameters. During this stage the crawler will access every link it discovers, including links in client-side scripts etc. During the scanning stage the scanner will send specially crafted HTTP requests which include a payload that is used to test if a website if vulnerable or not. Although automated scanners are designed not to be intrusive, there is still a probability that such attacks might tamper your web application or database, depending on how secure your web application already is. ## Advantages of automated tools * * * ## Speed: Automated Web Application security tools work fast. This is probably the biggest advantage you can get from automated web application security tools. During security testing, SDLC security testing, or other security assessment, complete manual approach almost always requires more time than automated approach. The price you pay ? False sense of security. Automated tools are useful during preliminary security assessment and even to rule certain types of vulnerabilities out, but don’t expect them to cover every single case. Properly integrated into SDLC, automated security tools can give developers an option to quickly test their code for vast majority of technical vulnerabilities. ## Coverage: Manual testing cannot possibly cover everything during (usually) limited time dedicated for security testing. Automated application security testing scores better in locating most common application-layer vulnerabilities and way better with code error detection, dead code detection and detection of other flaws that can lead to buggy software. You can eliminate huge number of reported vulnerabilities and code problems in very short amount of time. The price you pay ? False sense of security. It is advisable not to rely exclusively on these test. They are a part of your security assessment, not the only part. 0days, logical and other vulnerabilities may still exist in your code. ## Skill Set As web application security is relatively new, there is still a major gap between the number of jobs that are available and the number of highly qualified workforce. Skilled personnel is still pretty hard to find. This issue also overlap with another problem. Using human resources for security testing requires the security team to know an application inside-out. More often than not, your security team will not be in complete sync with your developers. This can lead to a wide range of human errors. With automated web application security testing, lesser personnel is needed to perform scanning and analysis. Security reports are generated automatically and results can be easily exported to user defined format. ‘The build’ can also be halted when a medium or severe level vulnerability is detected – something that can be pre-defined by your security team. Running automated tools is relatively simple task and usually easier than doing complete manual test. Manual penetration test obviously requires an expert or a team of experts, depending on the complexity of your application. ** _ _ ** ## Better ROI ** _ _ ** If implemented right, automated web application security testing enables the detection and mitigation of application layer vulnerabilities early in the software development life cycle. This saves your organization a lot of time, system and network resources and money. There is also no need to employ extra workers just to perform additional security testing. As long as you have security aware and knowledgeable developers, implementing automated web applications security testing during SDLC is by far the best way to increase your ROI. This is also the best and most preferable way of implementing automated web application security scanners in your organisation. The price you pay ? Large initial investment. Also, finding the right people can be… tricky… and time consuming. As we can see, automated web application security assessment tools have their place in web application security – and that they can be very useful and valuable if implemented right. But what does that really mean ? Well, for one it means that they are a tool in your arsenal, just not ‘the tool’. We can divide this ‘security’ into three sections. Three type of entities that are using these tools: * ** Entities that are developing their own product ** This is the place where automated tools really shine. As a part of SDLC, properly implemented automated tools and security testing procedures can be a very powerful allay. They can help detect and quickly eliminate vast majority of obvious vulnerabilities that your developers introduced while they were rushing to deliver functional PoC. [ Incremental and partial security scans ]() available in Netsparker [ie] are perfect example. Developers in, lets say agile environment can quickly test blocks of their code for predefined set of vulnerabilities and correct those errors right away. After all, they already know how the code works and they are familiar with code logic. Seamless integration of these tools and an attack on programmers ego are usually winning combination. Seamless integration can be a major problem here ( speaking as a former developer ). If your developers have to learn to use two or three additional complex tools that are unrelated to their coding skills, they will complain. Fortunately, some tools like [ Netsparker Cloud API ]() [ie] can integrate security testing into SDLC automatically. Security tests can be predefined and maintained in separate environment, allowing security testing team to dedicate their time to more exotic and/or recently discovered vulnerabilities. * ** Entities that are using someone elses product ** Using someone elses product is always a tricky thing, no matter how big the software package is or from whom does it comes from. Usually the bigger the software package is, the more vulnerabilities it introduce. There’s additional layer of problems here too. Many times, some x company will develop closed source application where your team will not have the ability to closer inspect the code or to perform any kind of source code change – mostly because of the licencing model. Automated tools can be used in this setup with limited and variable success. Automated tools can test your applications for all known vulnerabilities and provide initial estimate of how many ‘real ‘vulnerabilities are really present in that package. Other than that, you are usually left on your own or in the mercy of a company that developed the package. The bigger the company is, the smaller you are. The company may decide to respond to your vulnerability reports or to ignore them. Patches and security fixes may or may not be available for your product. This is the main disadvantage of these products. This does not mean that automated tools are not useful in these situations. However, the cost of your security assessment will continuously and linearly grow – especially if you decide/have to do black box type of assessment or to reverse the code. You can also use automated security testing tools to do some form of preliminary security assessment, that can (or may) influence your decision of whether or not you will use a certain tool or a package. Automated testing can provide an insight in how good development team behind some software package really is – by looking at the amount of known vulnerabilities in that package. Those are all valuable information for someone who is trying to determine whether or not to use some software packages. At the end, as a bottom line, due to the limited scope of these tests and inability to perform deep code inspection, beside reasonable expectation of security, you and your clients will almost always stay vulnerable to one or more attacks. * ** Entities that are doing or selling security testing services ** Automated web application scanners are also very useful for penetration testers during reconnaissance and information gathering phase during their security assessment. Automated tools can perform initial security tests and provide a treasure trove of valuable information to security professionals who are looking for weaknesses in some environment. Penetration testers can rule out or confirm many previously reported vulnerabilities and provide easy to read reports for upper management – or export data to other security tools. Much of this testing process can be too noisy for black-box testing and it can trigger WAF or other security mechanisms. Preferable use-case is white-box security testing in development environment. ## So, how do you decide ? If you ask two penetration testers which web application security scanner is better you will get two different answers. Every web vulnerability scanner has its own benefits and what works for one company will not necessarily work for some other company. So how do you decide which web application security scanner to use ? ### The most typical general requirements are: * ** Automate most of the tasks ** ; there are several advantages to automating the identification of web application vulnerabilities. * ** Lowering the costs of web application security ** by doing in house scanning rather than hiring an expensive penetration tester or service. * ** Increase the coverage ** ; as opposed to a penetration testers, an automated web application security scanner has an extensive set of [ heuristic web vulnerability checks ]() that are frequently updated by a number of researchers and security experts. This allows users to identify all type of web application vulnerabilities in custom made web applications. Some scanners also have a vulnerability database for known web applications that also comes in handy if your business or customers are using such web applications. In short, automated web application security scanners are mostly required to save time and to ensure that most technical web vulnerabilities are identified. ## Some of the basic security tests should include testing: * SQL Injection * XSS (Cross-site Scripting) * DOM XSS * Command Injection * Blind Command Injection * Local File Inclusions & Arbitrary File Reading * Remote File Inclusions * Remote Code Injection / Evaluation * CRLF / HTTP Header Injection / Response Splitting * Open Redirection * Frame Injection * Database User with Admin Privileges * Vulnerability – Database (Inferred vulnerabilities) * ViewState not Signed * ViewState not Encrypted * Web Backdoors * TRACE / TRACK Method Support Enabled * Disabled XSS Protection * ASP.NET Debugging Enabled * ASP.NET Trace Enabled * Accessible Backup Files * Accessible Apache Server-Status and Apache Server-Info pages * Accessible Hidden Resources * Vulnerable Crossdomain.xml File * Vulnerable Robots.txt File * Vulnerable Google Sitemap * Application Source Code Disclosure * Silverlight Client Access Policy File Vulnerable * CVS, GIT and SVN Information and Source Code Disclosure * PHPInfo() Pages Accessible and PHPInfo() Disclosure in other Pages * Sensitive Files Accessible * Redirect Response BODY Is Too Large * Redirect Response BODY Has Two Responses * Insecure Authentication Scheme Used Over HTTP * Password Transmitted over HTTP * Password Form Served over HTTP * Authentication Obtained by Brute Forcing * Basic Authentication Obtained over HTTP * Weak Credentials * E-mail Address Disclosure * Internal IP Disclosure * Directory Listing * Version Disclosure * Internal Path Disclosure * Access Denied Resources * MS Office Information Disclosure * Auto Complete Enabled * MySQL Username Disclosure * Default Page Security * Cookies not marked as Secure * Cookies not marked as HTTPOnly * Stack Trace Disclosure * Programming Error Message Disclosure * Database Error Message Disclosure All of these and many other, more advanced options are available in Netsparker, an easy-to-use web application vulnerability scanner that can crawl, attack and identify vulnerabilities in all web applications. This tool has a pretty low false positive rate because it performs multiple tests to confirm any identified issue. It also has a JavaScript engine which can parse, execute and analyse the output of JavaScript used in web applications. One of the main strength of Netsparker is its extensive configurability. There are so many options packed in this professional web application security tool hidden behind its simple to use, intuitive GUI. In order to ease SDLC integration and test scheduling, Netsparker team also implemented very helpful and rich CLI. Netsparker includes a number of built-in features that are designed to optimize scanning process like: * ## Multi-Threading * ## Parallel Scanning * ## Configurable Coverage * ## Configurable Scope * ## User-Selectable Parsing Engines * ## Intelligent Test Bypass One of the things that is very important but often missing from other web application scanners is, connection with other tools. Netsparker is currently able to import session data from Fiddler, Paros, Burp and other popular proxies and tools. Tools that currently inter-operate with Netsparker include: Metasploit, Metasploit Express, Metasploit Pro, Threadfix Vulnerability Manager, Kenna Security Vulnerability & Risk Intelligence (previously Risk I/O Vulnerability Dashboard), LunarLine Vulnerability Scan Converter and Dradis Framework. ## Netsparker Web Application Security Scanner UI ![Web Application Security Scanner: Netsparker](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/06/27133136/Netsparker-GUI.jpg) * * * Netsparker supports the following authentication methods: * ## Basic Authentication * ## Form Authentication * ## NTLM Authentication * ## Digest Authentication * ## Kerberos Authentication * ## SSL Client Certificate Authentication Netsparker Web Application Security Scanner can automatically scan and detect modern vulnerabilities and security issues typically found in web applications built using HTML5 technology. The Netsparker scanners have a state of art Chrome based crawler that enables them to simulate JavaScript and DOM on pages, thus they can fully understand and crawl all types of modern Web 2.0, HTML5 web applications and [ Single Page Applications ]() and identify vulnerabilities and security flaws in them. Netsparker is also able to identify web application vulnerabilities which are typically associated with modern HTML5 web applications, such as [ DOM based cross-site scripting ]() . Netsparker can scan the following type of web services: * WSDL 1.1 * SOAP 1.1 and 1.2 * REST API ( [ read about REST support ]() ) This web application security scanners will also automatically detect and properly handle custom 404 error pages and can automatically detect and report vulnerabilities in them. [ Netsparker scanners will heuristically detect URL Rewrite patterns and automatically configure themselves ]() to properly crawl and scan all the parameters on the target web applications. If you want to configure your own URL Rewrite rules you can override the automation and configure them via a user-friendly wizard. ## Reporting Finding and confirming security vulnerabilities is only a part of the story. You also need to visualize the vulnerability yourself, keep track of the security state of the target web application, and share your security findings with colleagues, developers and management. With Netsparker Web Application Security Scanner you can generate professional reports, as well design your own customer reports. ![Web Application Security Scanner: Netsparker reporting](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/06/27135627/reporting_1.jpg) Once a web application security scan is complete, results may be output to professional reports using rich report templates such as Detailed Scan Report, Comparison Report and OWASP Top 10 Report. Management can also produce comparison and trending reports to get a good overview of the security progress of a web application or a specific project, or generate a PCI compliance reports to ensure that the target web application is PCI compliant. Reports can be exported to common file formats such as HTML and PDF. ## Vulnerability Details & Exploitation One of the cornerstones of Netsparker’s design is its ability to [ automatically exploit suspected vulnerabilities in a safe and read only way ]() , proving them beyond doubt and reporting no false positives. Netsparker has been designed from the ground up to exclusively support this option and is currently the only web application security scanner with an integrated exploitation engine. By exploiting detected vulnerabilities in a safe and non-destructive manner, Netsparker is often able to yield additional detail about security vulnerabilities that are completely undetected by conventional security scanning techniques. It is, in most cases able to conclusively prove that an identified web application vulnerability is real and also generates either a Proof of Exploit or Proof of Concept. In cases when such confirmation is not possible, the vulnerability will be marked as “Possible”. For most detected vulnerabilities you will also get: * ## Detailed Vulnerability Specifications * ## Vulnerability Variants * ## Vulnerability Technical Details * ## Proof of Exploit or Concept * ## Vulnerability Impact * ## Remedy And Web Links References For certain types of vulnerabilities, Netsparker offers an integrated exploitation module that allows users to interactively exploit the vulnerability and see the real impact of an attack. Netsparker currently supports: * Exploitation of SQL Injection Vulnerabilities * Exploitation of LFI (Local File Inclusion) Vulnerabilities * Downloading source code of all crawled pages via LFI (Local File Inclusion) * Downloading known OS files via LFI (Local File Inclusion) * Exploitation of Remote Code Evaluation * Obtaining a reverse shell from exploiting SQL Injection, Remote File Inclusion and other vulnerabilities * Cross-site Scripting PoC generation On of the options that we really liked was how much control we can have over scanning process. Netsparker offers a wide range of manual overrides, enabling us to fine-tune our security scans to many different scenarios. We could then browse our web site through build in a proxy server and automatically adds URLs to scan session site map that can be then used in ‘controlled scan’ in which we could fine-tune vulnerability tests. True awesomeness ! * * * [ ![Web Application Security Scanner: Netsparker demo](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/04/08083329/inAction.png) ]() ## _ Use Netsparker to Identify Exploitable Vulnerabilities _ _ and Other Security Flaws in Your Websites & Web Applications Before Hackers _ ## Variations: * Netsparker Cloud * Netsparker Desktop Netsparker Cloud is an online, easy to use and scalable web application security scanning service that can automatically scan hundreds and thousands of websites for vulnerabilities and security flaws within just a few hours, with the minimum amount of effort. The multi-user platform has all the tools teams require to ensure that all identified vulnerabilities are fixed within a reasonable time frame. Netsparker Cloud can also be easily integrated into the enterprises SDLC to ensure that all web applications are scanned throughout every stage of the development, and ensure that all vulnerabilities are fixed once the web application is launched in the live environment. * * * Netsparker Desktop is an easy-to-use yet powerful web application security scanner that allows you to scan websites, web applications, and web services automatically and identify vulnerabilities and security flaws in them. Netsparker Desktop can scan all types of web applications, regardless of the platform they run on or the technology they are built with. ## Minimum System Requirements * Microsoft Windows Vista or Windows Server 2008 or higher (x64 recommended) * Microsoft Internet Explorer 9 or higher * Microsoft .NET Framework 4.6.1 * 1Ghz Pentium processor or higher (Intel i7 1.6GHz or higher recommended) * 1GB of available RAM (4GB recommended) * 100 MB of HDD space for installation and an additional 100 MB for scanning, with up to 4.2 GB required per scan, depending on target application size [ ![Web Application Security Scanner: Netsparker howto and tutorials](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/06/27131653/howto.jpg) ]() * * * [ ![Web Application Security Scanner: Netsparker Download](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/05/08082805/Download3.png) ]()