Network.Security.Tools [Electronic resources] نسخه متنی

Chapter 8. Developing Web Assessment Tools and Scripts

Web application
vulnerabilities
are increasingly becoming the attacker's method of
choice for compromising systems and obtaining access to valuable
data. Although most organizations have a reliable process in place
for identifying and defending perimeter hosts from traditional
network-based attacks, often little or no attention is paid to
security over custom web applications that are deployed to allow
employees, customers, or business partners to access company data. In
addition, although a myriad of tools is available to automatically
assess and identify network-based vulnerabilities, open source and
freeware alternatives for identifying vulnerabilities in custom web
applications are lacking. In this chapter, we walk through the
process of developing a simple web application scanner using the Perl
scripting language and its powerful LWP module.

It is important to define the types of vulnerabilities we identify in
this chapter. Many people think CGI scanners, such as
Nikto (discussed in Chapter 4), are considered web application scanners.
Although these scanners do in fact have the potential to identify
"known" vulnerabilities in specific
pages or files, they do not identify vulnerabilities that are unique
to a given web application. For example, the popular PHPNuke
application has multiple vulnerabilities for which Nikto contains a
signature, but a Nikto signature is unlikely to be available for a
vulnerability that might be present in a custom web application your
company has built. To identify these unique vulnerabilities, the
scanner must be able to dynamically generate test requests that are
tailored specifically to a given web application.

This chapter introduces two simple Perl scripts you can use to assess
a custom web application for common vulnerabilities. Before we begin
developing the scripts, however, you must first understand the nature
of web application vulnerabilities and the environment in which these
applications operate.