Web application security scanner

A web application security scanner is program which communicates with a web application through the web front-end in order to identify potential security weaknesses in the web application. [ [http://www.myappsecurity.com/wassec/index.php5?title=Technicaldraft Technicaldraft - WASC - WASSEC ] ] It performs a black-box test. Unlike source code scanners, web application scanners don't have access to the source code and therefore detect vulnerabilities by actually performing attacks.

Overview

A web application security scanner can facilitate the automated review of a web application with the expressed purpose of discovering security vulnerabilities, and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, including:
* Input/Output validation: (Cross-site scripting, SQL Injection)
* Specific application problems
* Server configuration mistakes/errors/version

trengths and weaknesses

Like every testing tools, the web application security scanner is not a perfect tool, it has strength and weaknesses.

Weaknesses and limitations

* Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself. The penetration tester should look at the coverage of the web application or of its attack surface in order to know if the scanner was configured correctly or was able to understand the web application.
* It is really hard for a tool to find logical flaws such as the use of weak cryptographic functions, information leakage, etc.
* Even for technical flaws, if the web application doesn't give enough clue, the tool cannot catch it
* The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have classical attacks and not the more complicated ones.
* The tools are usually limited in the understanding of the application behavioral with dynamic content such as JavaScript, Flash, etc.

trengths

* The tool can detect vulnerabilities of the finalized release candidate before shipping
* It simulates a real attacker by performing attacks and tries to probe what results are not part of the expected result set
* As a dynamic testing tool, it is not language dependent. A web application scanner is able to scan JSP, PHP or any other engine driven web application.

Related projects

* NIST SAMATE Project: http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners
* Web Application Security Consortium: http://webappsec.org/projects/wassec/

Notes