Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/15/2013
01:45 AM
50%
50%

Web Application Testing Using Real-World Attacks

Using exploits to test Web applications can be an enlightening way to test for vulnerabilities, but there are downsides as well

Vulnerability management and scanning systems typically combine a number of techniques to assess the risk faced by a business' information technology, from scanning files and evaluating the current patch level to launching attacks and testing for practical vulnerabilities.

While assessing patch level tends to be the most reliable way to check for vulnerable code, there are times when real-world exploits are needed. In cases where the patch has not been correctly applied, or when there is no patch, the best way to check for the vulnerability is to actually probe the application. Custom Web applications, for example, will generally not be able to be assessed using a patch-level check, says Ross Barrett, senior manager for security engineering at Rapid7, a vulnerability management firm.

"If a company has in-house Web apps, that is where you are going to get a lot of value out of that approach," he says. "The real-world attacks can be replayed and give you results."

Using actual exploits to test for vulnerabilities is an old technique that turns a vulnerability scan into an automated penetration test rather than a catalog of the system's patch level. Exploitation, however, can result in system instability, a danger that causes many companies to be wary of active probes of their networks or Internet applications, says Lamar Bailey, director of security research for risk-management firm nCircle, now owned by Tripwire.

"It's tricky to use real exploits because you have to neuter them," Bailey says. "We got a lot of pushback from customers -- they would not run a lot of the tests -- because they did not want production servers to go down."

[Fear of business disruption and downtime often leaves enterprises hesitant to scan the critical applications that hackers are most likely to target in their quest for exploitable vulnerabilities. See Too Scared To Scan.]

Moreover, exploits are not 100 percent reliable, he says. With current anti-exploitation techniques -- such as address layout randomization and data-execution protection -- success in forcing exploit writers to track complex system states tends not to be a given, Bailey says.

"The fact that you could not get into the box does not mean that the box is not vulnerable," he says.

Web applications are a good match for exploit-based scanning because applications that continually deal with the Internet tend to be more robust, Bailey says. In addition, many of the types of attacks that threaten Web applications, such as cross-site scripting and SQL injection, are at low risk of causing downtime.

"As long as you don't crash anything and you tell the company what changes you made, many of them will let you use active techniques against a Web application," Bailey says. Using actual attack intelligence can help direct vulnerability testing as well. By looking at incoming attacks, security teams can replicate them and discover whether the business' systems are vulnerable to exploits. By automating the exploitation process, a company can turn attack research into defense, says Jason Schmitt, director of product management for Hewlett-Packard's Fortify business unit.

"The automation is about capturing the security-research expertise to give our customers a current perspective on the types of threats out there," he says.

The reverse works as well, Rapid7's Barrett says.

"There is a lot of noise to filter through," he says. "So tying the attack traffic into your vulnerability situation can tell you what you are actually vulnerable to, and that's hugely valuable."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AccessServices
50%
50%
AccessServices,
User Rank: Apprentice
5/16/2013 | 1:32:45 PM
re: Web Application Testing Using Real-World Attacks
I agree with Barry if the company has a good SDLC. One could also use copies of production virtual servers to create a test environment with a sample database if the company did not send everything through QA.
Barry Shteiman
50%
50%
Barry Shteiman,
User Rank: Apprentice
5/15/2013 | 5:55:48 PM
re: Web Application Testing Using Real-World Attacks
A good portion of the larger enterprises and the government agencies of the world, have staging and production-like sites that allow them to test for things like system load and version control, that is where testing of this kind might be effective if performed under a monitored environment.

Having security controls in staging environments is key to large scale release management making sure that the controls put in place are effectively doing what they are meant to.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6486
PUBLISHED: 2020-07-10
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none.
CVE-2012-6487
PUBLISHED: 2020-07-10
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none.
CVE-2012-6488
PUBLISHED: 2020-07-10
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none.
CVE-2012-6489
PUBLISHED: 2020-07-10
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none.
CVE-2012-6490
PUBLISHED: 2020-07-10
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none.