A.5. Web Application Security Tools

Web security tools provide four types of functionality, and there is a growing trend to integrate all the types into a single package. The four different types are:

Scanners

Execute a predetermined set of requests, analyzing responses to detect configuration errors and known vulnerabilities. They can discover vulnerabilities in custom applications by mutating request parameters.

Crawlers

Map the web site and analyze the source code of every response to discover "invisible" information: links, email addresses, comments, hidden form fields, etc.

Assessment proxies

Standing in the middle, between a browser and the target, assessment proxies record the information that passes by, and allow requests to be modified on the fly.

Utilities

Utilities used for brute-force password attacks, DoS attacks, encoding and decoding of data.

Many free (and some open source) web security tools are available:

• Paros (http://www.parosproxy.org)

• Burp proxy (http://www.portswigger.net/proxy/)

• Brutus (password cracker; http://www.hoobie.net/brutus/)

• Burp spider (http://portswigger.net/spider/)

• Sock (http://portswigger.net/sock/)

• WebScarab (http://www.owasp.org/software/webscarab.html)

These tools are rich in functionality but lacking in documentation and quality control. Some functions in their user interfaces can be less than obvious (this is not to say commercial tools are always user friendly), so expect to spend some time figuring out how they work. The trend is to use Java on the client side, making the tools work on most desktop platforms.

Paros and WebScarab compete for the title of the most useful and complete free tool. The Burp tools show potential, but lack integration and polish.

A.5.1. Paros

Paros (see Figure A-9) will probably fill most of your web security assessment needs. It can be used to do the following:

• Work as a proxy with support for HTTP and HTTPS

• Crawl the site to discover links

• Visualize the application

• Intercept (and optionally modify) requests and responses

• Run filters on requests and responses

• Examine recorded traffic

• Perform automated tests on dynamic pages

Figure A-9. Paros allows for web site visualization

A.5.2. Commercial Web Security Tools

If you are more interested in commercial tools than in open source ones, many are available. Categorizing them is sometimes difficult because they often include all features of interest to web security professionals in one single package. Most tools are a combination of scanner and proxy, with a bunch of utilities thrown in. So, unlike the open source tools where you have to use many applications from different authors, with a commercial tool you are likely to find all you need in one place. Commercial web security tools offer many benefits:

Integration

You get all the tools you need in a single, consistent, often easy-to-use package.

A collection of base signatures

Base signatures cover common configuration problems and web security vulnerabilities. These signatures can be very important if you are just starting to do web security and you do not know where to look.

Up-to-date signature database

Having an up-to-data database of signatures, which covers web server vulnerabilities and vulnerabilities in dozens of publicly available software packages, is a big plus if you need to perform black-box assessment quickly.

Reporting

With a good commercial tool, it is easy to create a comprehensive and good-looking report. If your time is limited and you need to please the customer (or the boss), a commercial tool is practically the only way to go.

One significant disadvantage is the cost. The area of web application security is still very young, so it is natural that tools are expensive. From looking at the benefits above, employees of larger companies and web security consultants are the most likely to buy commercial tools. Members of these groups are faced with the unknown, have limited time available, and must present themselves well. An expensive commercial tool often increases a consultant's credibility in the eyes of a client.

Here are some of the well-known commercial tools:

• SPI Dynamics WebInspect (http://www.spidynamics.com)

• WatchFire AppScan (http://www.watchfire.com)

• Kavado ScanDo (http://www.kavado.com)

• N-Stalker's N-Stealth (http://www.nstalker.com)

• Syhunt TS Security Scanner (http://www.syhunt.com)