-: Web Application Vulnerability Scanning.
So, we've talked all about these different coding
processes and where are you gonna see it the most
as a cyber security analyst?
Well, you're probably gonna see it in web apps
because in web apps you're gonna be able to analyze
a lotta the source code and it's one of the biggest places
we have vulnerabilities and one of the biggest places
that people create their own software in house.
So, when you look at web application vulnerability
scanning, there are dedicated web application
vulnerability scanners and they do a much better job
than Nessus, Nexpose and OpenVAS, QualysGuard
and some of those other scanners we talked about
way back in vulnerability management.
Now, this is gonna help us to identify problems
with the applications as well as some of the underlying
web servers, databases and infrastructures.
Some of these for example, we have things like
Acunetix Web Vulnerability Scanners, Archni, Burp Suite,
IBM's AppScan, HP's WebInspect, Netsparter, QualysGuard's
Web Application Scanner and W3AF.
These are just some of the web application
vulnerability scanners out there.
There are many, many more.
Now, what do these look like?
Well, they look a lot like Nessus and QualysGuard
to be honest.
Here is an example from Acunetix, right.
It's done a scan and it's found the vulnerabilities.
The big difference here is these have plugins
that are developed specifically to look at web attacks.
Things like, HTML forms that are incorrect,
things like SQL injections, things like crossite
scripting and they're gonna come back with a nice,
pretty report just like this that'll tell you
where the highs are, where the mediums are
and where the lows are.
So, you can see here, this looks a lot like it did
in Nesses when you drill that into a specific vulnerability.
Here's an example of a high severity one.
This was an SQL injection that was verified.
Acunetix attempted an SQL injection and was successful.
Now, the big difference here between this
and something like Nessus or QualysGuard
that we've used earlier on is that when you go to find
the fix, it's not necessarily gonna be a patch, right.
Because you have probably developed your own SQL queries
for your website.
You've created your own set of databases and your own
certain codes that you're using.
And so, if that's the case, those things like Nessus
aren't gonna find them.
They'll find the default issues like the underlying system
of work press maybe, but they're not gonna find
and fix your SQL injections for you.
And so, for these you're gonna have to re-code those areas,
but it's okay because here they're gonna tell you,
here's how you fix it and they'll give you an example
of detailed instructions of where the issue was,
how they broke into it and what you can do to secure it.
Now, you can also do a manual scanning
and most of the time you're gonna have to do at least
some manual scanning.
These automated tools are great.
Acunetix and WebInspect and the others are great, great
tools, but they're not gonna find everything
and so you need to use an interception proxy
and what that is gonna do is it's gonna capture
the communications between your browser and your server.
Penetration testers do this all the time.
This is something that a cyber security analyst may do,
but if you're in the penetration testing world,
you're definitely gonna do it.
Testers are able to modify the data that's being sent
and received between the browser and the server
causing issues, right, and that's what you're trying to do
is see if you can cause issues to the website so that
then, you can make sure that hackers can't
do the same thing to you.
Some examples of tools that allow you to do this
is Tamper Data, which is an extension for Firefox
and Chrome.
There's also HttpFox.
There's Fiddler and of course, the most popular one,
Burp Suite.
So, Tamper Data.
Here's an example of that.
This is a Firefox extension like I said, there is
a Chrome one now, too, but it allows you to connect
to the website and it'll start telling you
what were all the get requests, what were all
the receiver requests you've gotten.
What was the data you got?
And then, you can actually go in and send data
and modify it and see if that will break it.
For instance, if I was testing an eCommerce site
I may wanna get to the shopping cart screen
and then see if I could change that $100 product
to a $10, right, see if I can modify the price.
If I can, that's bad for the eCommerce organization
on PIN testing and so I wanna let them know that
and let them get that fixed.
So, here I have an example of Burp Suite.
Burp Suite has automated and manual modes.
In the automated mode it works a lot like Acunetix
or WebInspect where it's gonna go through and try
to do some different attacks for you and see
if it can break in and give you a report on them.
But, in the manual modes it allows you to do some
of those things like Tamper Data did where you can
go and modify the things.
It will have modes where you can go into a manual mode
and do process scripting attacks, cross site forgery attacks
and others.
Burp Suite is a very, very powerful tool.
For the CSA Plus exam you don't need to know
how to use Burp Suite, but you should know
what Burp Suite is.
Whenever you hear Burp Suite, think web
application vulnerability testing, right,
in PIN testing or in scanning, right.
That's what we're gonna use it for, web applications.
And that's it as far as you know, for the exam itself.
Now, as a cyber security analyst or a PIN tester,
you are gonna wanna become comfortable with Burp Suite.
And so, I would look into getting a separate course
that will dig in deep of how to do the hands on
type of things with Burp Suite because it is
a very, very powerful tool.
Now, the last thing you can do if you're not gonna
do all this in-house is you can outsource it.
You can outsource your scanning for web application
vulnerabilities.
Even in your best vulnerability scanners,
those automated ones, are gonna miss business
logic issues and other flaws.
That's why we do code reviews.
That's why we do all this other stuff.
But, if you don't have that technology in house
and the people in house who can do it,
that's when you can outsource it to a security firm.
This is when you outsource to a PIN tester, right.
They can identify issues with your web applications
that your scanners are just gonna miss.
These firms can provide both static and dynamic
analysis of your applications and provide you
a detailed report and even help you fix the issues
in your vulnerabilities themselves.
So, when in doubt, if you can't find issues yourself
or you think you want a little extra layer of confidence
and protection go and hire an expert.
Hire one of these consulting companies.
Hire one of these security firms.
They can help you out and do a PIN test
on your web apps for you.