Dynamic application security testing

A web application security scanner is program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses. It performs a black-box test. Unlike source code scanners, web application scanners don't have access to the source code and therefore detect vulnerabilities by actually performing attacks.

Overview

A web application security scanner can facilitate the automated review of a web application with the expressed purpose of discovering security vulnerabilities, and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, including:

• Input/Output validation: (Cross-site scripting, SQL Injection, etc.)
• Specific application problems
• Server configuration mistakes/errors/version

Strengths and weaknesses

Like every testing tools, the web application security scanner is not a perfect tool, it has strength and weaknesses.

Weaknesses and limitations

• Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself. The penetration tester should look at the coverage of the web application or of its attack surface to know if the tool was configured correctly or was able to understand the web application.
• It is really hard for a tool to find logical flaws such as the use of weak cryptographic functions, information leakage, etc.
• Even for technical flaws, if the web application doesn't give enough clue, the tool cannot catch them
• The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have a predefined list of attacks and does not generate the attack payloads depending on the tested web application.
• The tools are usually limited in the understanding of the application behavioral with dynamic content such as JavaScript, Flash, etc.

Strengths

• The tool can detect vulnerabilities of the finalized release candidate before shipping
• It simulates a malicious user by attacking and probing, and seeing what results are not part of the expected result set
• As a dynamic testing tool, it is not language dependent. A web application scanner is able to scan JAVA/JSP, PHP or any other engine driven web application.

External links

• Web Application Security Scanner Evaluation Criteria from the Web Application Security Consortium (WASC)
• Web Application Vulnerability Scanners, a wiki operated by the National Institute of Standards and Technology