Network.Security.Tools [Electronic resources] نسخه متنی

Chapter 9. Automated Exploit Tools

In the world of vulnerability
scanners, false positives are a common and unfortunate side effect. A
false positive arises when an assessment tool reports a vulnerability
even though the vulnerability doesn't exist. Most
vulnerability scanners won't actually exploit the
vulnerability they are attempting to detect, but this is often the
most accurate method of determining whether a vulnerability truly
exists. In this chapter, we look at how to build some automated
exploit routines into the web application vulnerability scanner we
developed in the previous chapter. This will serve both to minimize
the number of false positives reported, and to save time when
attempting to develop proof-of-concept exploits for demonstrating the
vulnerability's impact. You should consider this
chapter to be an extension of Chapter 8, so if
you haven't read Chapter 8
yet, you'll want to do so before continuing.

The primary reason for automating manual exploits is to save valuable
time and effort when performing security assessments. Brute-force
routines in various tools provide a good example of how automation
has historically been applied to vulnerability exploits. Whether in
password-cracking utilities such as John the Ripper or in a buffer
overflow exploit script to obtain the correct offset value, the goal
is to perform tasks that aren't feasible by hand or
would take a significant amount of time to perform manually. For this
chapter, we've chosen SQL injection as the
vulnerability for which we will build an automated exploit engine.
SQL injection is a good candidate for automation because
well-defined, methodical techniques exist for constructing a working
exploit. Additionally, a successful exploit often requires numerous
requests to construct the correct syntax. Adding the exploit engine
also broadens our criteria for detecting potential vulnerabilities.
The exploit engine discovers a larger range of vulnerabilities, and
confirming whether a vulnerability actually exists eliminates false
positive results reported by the tool.