Overview Of Different Web Vulnerability Scanners Computer Science Essay

This paper classifies an overview of different Web Vulnerability Scanners. Web Vulnerability Scanners verifies whether Web based applications are vulnerable or secure when they are subjected to malicious input data. Web Vulnerability scanners are designed to discover security holes in your web applications that an attacker can access to your systems and data. It looks for multiple vulnerabilities including SQL injection, cross site scripting, information leakage etc.

This paper describes the design of a test suite for thorough evaluation of different web Vulnerability scanners. For several common vulnerability types, the researchers evaluate how different scanners work and they can be implemented. This approach allows developer/researcher to develop an extensive good scanner. This paper proposed to evaluate the test suite experimentally using several web application scanners. In addition, this paper suggests improvement for Web Vulnerability Scanner.

Keywords: Web Scanner, SQL Injection, Cross Site Scripting, web crawler, Input Vector, Web application vulnerability

2. INTRODUCTION

Web application is becoming more and more popular and important part of our lives. As the important role of web application, the web security is becoming critical. In computer security, the term vulnerability is applied to a weakness in a system that allows an attacker to violate the integrity of that system.[1] Many web vulnerabilities result from generic input validation problems. Examples of such vulnerabilities are SQL Injection and Cross-Site Scripting (XSS).Web Vulnerability scanners are designed to discover security holes in your web applications that an attacker can access to your systems and data [1]. It looks for multiple vulnerabilities including SQL injection, cross site scripting, information leakage, Content Spoofing, Malicious File Execution, Parameter Modification, Directory Traversal etc. Detecting vulnerabilities is generally not an easy task, and not all of the common vulnerabilities can be successfully detected by automated scanners [2].

There are two main approaches to testing software applications for the presence of bugs and vulnerabilities: [6]

• In white-box testing, the source code of the application is analyzed in an attempt to track down defective or vulnerable lines of code. This operation is often integrated into the development process by creating add-on tools for common development environments.

• In black-box testing, the source code is not examined directly. Instead, special input test cases are generated and sent to the application. Then, the results returned by the application are analyzed for unexpected behavior that indicates errors or vulnerabilities.

The scope of this paper is limited to study the various vulnerabilities scanners and the technique of assessing the vulnerability in web application and providing the protection according to their approach to web application. For several common vulnerability types, we evaluate how different scanners work and they can be implemented. This approach allows us to develop an extensive good scanner.

3. LIST OF WEB APPLICATION SCANNERS [12]

Arachni

IBM AppScan (IBM)

Web Inspect (HP)

Nets parker (Mavituna Security)

Acunetix WVS (Acunetix)

Burp Suite (Portswigger)

WebCruiser (Janus Security)

Nessus (Tenable Network Security)

Ammonite (RyscCorp)

SecuBat

OWASP Zed Attack Proxy Project

w3af

Vega

Nexpose

Web Surgery

4. OVERVIEW OF WEB APPLICATION SCANNERS

4.1 Acunetix

Acunetix WVS automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.[9]

Work:

Quick scanning

Specify custom error pages

Combines many tools into one application and authentication test in both http and html form

High detection rate of vulnerabilities

Does not overrate minor vulnerabilities

Drawbacks:

Reporting is not robust

Target identifier appeared to be buggy

Could use some interface tweaks – in spider have to limit the depth of links

4.2 SecuBat

SecuBat, which is focused on the identification of a broad range of general application-level vulnerabilities. SecuBat, a generic and modular web vulnerability scanner that analyzes web sites for exploitable SQL and XSS vulnerabilities. Developer used SecuBat to identify a large number of potentially vulnerable web sites [6].

Work:

Black-box approach to craw and scan web sites for the presence of exploitable SQL injection and XSS vulnerabilities.

4.3 Nessus

The Nessus Vulnerability Scanner is the most popular broad based scanner and is commonly used by internal and external teams performing security assessments. It has a large number and wide variety of plug-in, scanning tests, that continues to grow. Nessus is available free of charge at Tenable Network Security’s website www.tenablesecurity.com [14].

Drawbacks:

The most difficult scenario is when some combination of plug-in causes the fault.

problems in the patch management process

4.4 Nexpose

NeXpose is the first vulnerability scanning solution that analyzes JavaScript, AJAX and Flash applications in testing. Detects more vulnerabilities than traditional Web scanners. Nexpose identifies vulnerabilities throughout the entire application, scanning the browser and server-side components for exposures that other Web application scanners do not find.[11]

Work:

Reduces scan times and allows customers to target specific and mission critical addresses.

Secures the complete Web application.

Scans client-side Web applications to find vulnerabilities in Web 2.0 technologies such as JavaScript, AJAX, and Flash.

Drawbacks:

The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have a predefined list of attacks and do not generate the attack payloads depending on the tested web application.

4.5 OWASP Zed Attack Proxy Project

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.[15]

4.6 w3af

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend. This project is currently hosted at Source Forge. list of plug-in that are available in w3af [15].

4.7 Vega

Vega is an open source platform to test the security of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.

Vega includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. Vega can be extended using a powerful API in the language of the web: JavaScript.[15]

4.8 Arachni

Arachni is a high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. Arachni is smart and it trains itself by learning from the HTTP responses it receives during the audit process.

Work:

Helper audit methods, for forms, links and cookies auditing.

A wide range of injection strings/input combinations.

Free, power full and monthly updated.

4.9 Websecurify

Websecurify is an integrated web security testing environment, which can be used to identify web vulnerabilities by using advanced browser automation, discovery and fuzzing technologies. The platform is designed to perform automated as well as manual vulnerability tests and it is constantly improved and fine-tuned by a team of world class web application security penetration testers and the feedback from an active open source community.

The built-in vulnerability scanner and analyze engine are capable of automatically detecting many types of web application vulnerabilities as you proceed with the penetration test.[15]

4.10 Burp suit

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. Free and paid editions are available.

4.11 Nets parker

Nets parker will try lots of different things to confirm identified issues. If it can’t confirm it and if it requires manual inspection, it’ll inform you about a potential issue generally prefixed as (Possible) , but if it’s confirmed, that’s it. It’s a vulnerability. You can trust it.

Netsparker confirms vulnerabilities by exploiting them in a safe manner. If a vulnerability is successfully exploited it can’t be a false-positive. Exploitation is carried out in a non-destructive way.[15]

4.12 Web Surgery

Web Surgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer for advanced exploitation of known and unusual vulnerabilities such as SQL Injections, Cross site scripting (XSS), brute-force for login forms, identification of firewall-filtered rules etc.[15]

4.13 IBM Rational AppScan

IBM Rational AppScan is an industry leading web application security testing tool that scans and tests for all common web application vulnerabilities – including those identified in the SQL-Injection, Cross-site Scripting and Buffer Overflow.[10]

5 .SCANNER VERSATILITY- Input Vector Support

Modern web applications use a variety of sub-protocols and methods for delivering complex inputs from the browser to the server. These methods include standard input delivery methods such as HTTP query string parameters and HTTP body parameters, modern delivery methods such as JSON and XML, and even binary delivery methods for technology specific objects such as AMF, Java serialized objects and WCF.[12] some of input vectors are GET, POST ,COOKIE ,HEADER ,SECRET ,PName, XML ,XmlATT ,XmlTAG ,JSON ,.NetENC ,AMF ,JavaSER ,.NetSER ,WCF ,WCF-Bin ,WebSock ,DWR etc.[12]

Identifying the input vectors of a web application and checking the results of an attack are important parts of penetration testing, as they indicate where an attack could be introduced and whether an attempted attack was successful. Current techniques for identifying input vectors and checking attack results are typically ad-hoc and incomplete, which can cause parts of an application to be untested and leave vulnerabilities undiscovered. [13]

Table-1: The Number of Input Vectors Supported by Vulnerability scanners

Rank

Input vectors

Vulnerability scanner

1

13

IBM AppScan

2

11

Burp Suite professional

3

10

Iron WASP

4

7

Acunetix WVS (commercial)

5

5

Acunetix WVS freeware,

W3AF ,

Nessus

6

4

Netsparker,

Arachni

7

3

Vega,

Web Cruiser

8

2

Web Surgery,

Zed Attack Proxy Project

6. LIMITATION OF VULNERABILITY SCANNERS

Web application vulnerability scanners are not capable of detecting all of the vulnerabilities and attack vectors that exist.

It cannot cover 100% of the source code of the application and then, the application itself.

It is really hard for a tool to find logical flaws such as the use of weak cryptographic functions, information leakage, etc…

Many false-negatives and false-positives.

Many tools are usually limited in their understanding of the behavior of applications with dynamic content such as JavaScript, Flash, etc.

The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have a predefined list of attacks and do not generate the attack payloads depending on the tested web application.

Web application flaws remain unchanged

Failures in spidering techniques.

7. CONCLUSIONS

The main contribution of this research paper is to show how easy it is to automatically discover and exploit web application- level vulnerabilities in a large number of web applications. Many web application security vulnerabilities result from generic input validation problems. Examples of such vulnerabilities are SQL Injection and Cross-Site Scripting (XSS). Although the majority of web vulnerabilities are easy to understand and avoid, many web developers are unfortunately not security-aware and there is general consensus that there exist a large number of vulnerable applications and web sites on the web. Automated Vulnerability Detection method based on web crawling is proposed in this research paper. To the end, this paper helps you to suggest areas for Web Vulnerability Scanner tool improvement and it allows us to develop an extensive good scanner. This paper describes the design of a test suite for thorough evaluation of different web Vulnerability scanners. For several common vulnerability types, people evaluate how different scanners work and they can be implemented. This approach allows developer to develop an extensive good scanner. This paper proposed to evaluate the test suite experimentally using several web application scanners. In addition, this paper helps you to suggest areas for Web Vulnerability Scanner tool improvement.

8. REFRENCES

[01] V. Suhina , S. Gros , Z. Kalafatic. Detecting vulnerabilities in Web applications by clustering Web pages. (pp. 01-03 ). Faculty of Electrical Engineering and Computing, University of Zagreb , Croatia

[02] Andrey Petukhov , Dmitry Kozlov (2008). Detecting Security Vulnerabilities in Web Applications Using Dynamic Analysis with Penetration Testing. (pp. 01-05 ) Dept. of Computer Science, Moscow State University. 

[03] Nuno Antunes , Marco Vieira (2012). Defending against Web Application Vulnerabilities. (pp. 66-72) Published by the IEEE Computer Society. University of Coimbra, Portugal, 0018-9162/12/$31.00 © 2012 IEEE, vol.-2,p.- 66-72.

[04] Jeremiah Grossman White Hat Security founder & CTO (2008). Website Vulnerabilities Reveale. (pp. 08-14) . WhiteHat Security

[05] Dafydd Stuttard , Marcus Pinto (2011). The Web application Hacker’s Handbook Finding an Exploiting Security Flaws. Second edition

[06] Stefan Kals, Engin Kirda, Christopher Kruegel , Nenad. SecuBat: A Web Vulnerability Scanner. Secure Systems Lab, Technical University of Vienna

[07] David Shelly, Randy Marchany, Joseph Tront (2010). Analyzing the Limitations of Web Application Vulnerability Scanners. Virginia Polytechnic Institute and State University

[08] Katkar Anjali S , Kulkarni Raj B (2012). Web Vulnerability Detection and Security Mechanism. (pp. 237-241) International Journal of Soft Computing and Engineering (IJSCE). ISSN: 2231-2307, Volume-2, Issue-4, p.-237-241 

[09] Acunetix WVS (2004) . Acunetix web vulnerability scanner a real world review (pp. 02-20) Available at http://www.acunetix.com

[10] IBM Corporation Software Group (2008). IBM Rational AppScan enhancing Web application security. NY 10589 U.S.A

[11] Rapid7 Corporate. Nexpose Web Application Scanner. (pp 01-05). Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617 Available at www.rapid7.com

[12] Scanner Versatility. Available at http://sectooladdict.blogspot.co.il/

[13]William G.J. Halfond, Shauvik Roy Choudhary, Alessandro Orso..Penetration Testing with Improved Input Vector Identification. (pp. 01-03). College of Computing ,Georgia Institute of Technology.

[14] Nessus Available at www.tenable.com/products/nessus

[15] “Scanner tools information” Available at https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools