The Acunetix Web Vulnerability Scanner

Transcription

1 The Acunetix Web Vulnerability Scanner Website security is pssibly tday's mst verlked aspect f securing the enterprise and shuld be a pririty in any rganizatin. Increasingly, hackers are cncentrating their effrts n webbased applicatins - shpping carts, frms, lgin pages, dynamic cntent, and ther bespke applicatins t btain access and t misuse cntrl sensitive data such as custmer details, credit card numbers and prprietary crprate data. Available 24 hurs a day, 7 days a week such web applicatins ften have direct access t backend data such as custmer databases. Netwrk security defense prvides n prtectin against web applicatin attacks since these are launched n prt 80 which has t remain pen t allw regular peratin f the business. In additin, web applicatins are mre pen t uncvered vulnerabilities since these are generally custm-built and, therefre, pass thrugh a lesser degree f testing than ff-the-shelf sftware. Auditing a website fr vulnerabilities manually is impssible scanning must be dne autmatically and regularly. On the ther hand, autmatic scanning must prvide the peace f mind that all vulnerabilities are uncvered s as t cmpletely prtect sensitive data. Hackers already have a wide repertire f attacks that they can launch against rganizatins including SQL Injectin, Crss Site Scripting, Directry Traversal Attacks, Parameter (e.g., URL, Ckie, HTTP headers, HTML Frms) Manipulatin, Authenticatin Attacks, Directry Enumeratin and ther explits. The hacker cmmunity is als very clse-knit; newly discvered Web applicatin intrusins are psted n a number f cmmunity frums and websites knwn nly t members f that exclusive grup. Pstings are updated n a daily basis and are used t prpagate and facilitate further hacking. The Acunetix Web Vulnerability Scanner (WVS) is suitable fr any small, medium sized and large rganizatins with intranets, extranets, and websites aimed at exchanging and/r delivering infrmatin with/t custmers, vendrs, emplyees and ther stakehlders. The Acunetix Web Vulnerability Scanner (WVS) bradens the scpe f vulnerability scanning by intrducing advanced and highly rigrus technlgies t tackle the cmplexities f tday's cmplex web-based envirnments. Besides autmatically scanning fr all vulnerabilities, WVS ffers a strng and unique slutin fr analyzing web applicatins and websites that rely n JavaScript including AJAX applicatins. It is these custm web applicatins that hackers always fcus; the mre the applicatin is ppular, the better. The slutin is cmpatible with any technlgy that perates ver HTTP/HTTPS. In general, WVS scans any website r web applicatin that is accessible via a web brwser and that respects HTTP/HTTPS rules. The Acunetix WVS vulnerability database is nt limited t knwn specific applicatins (e.g. ffthe-shelf shpping carts) and/r mdule vulnerabilities (e.g. SQL injectin in phpbb Lgin Frm). If it were t d s, custm applicatins wuld remain untested fr vulnerabilities. WVS "assumes" that all websites are uniquely structured and cded - WVS first crawls the entire website, analyzing in-depth each file it finds, and displaying the entire website structure. After this discvery stage, it perfrms an autmatic audit fr knwn security vulnerabilities by launching a P a g e 1

2 series f Web attacks. WVS checks fr vulnerabilities n the web server and web applicatin server and in website cntent itself. Mst imprtant is the ability f WVS t analyze different Web technlgies, such as HTML, PHP, ASP.NET, ASP, etc.. Put simply, WVS answers the questins: which parts f a website we thught are secure are in fact pen t hack attacks? and what data can we thrw at an applicatin t cause it t perfrm smething it shuldn t d?. WVS allws users t scan autmatically fr knwn vulnerabilities accrding t a regularly updated database while als ensuring ther frms f intelligent vulnerability scans thrugh manual interventin. In additin, WVS permits users t perfrm cmprehensive autmated hacking attacks that are nt tied t particular applicatins. This allws the testing f custm applicatins irrespective f hw and when they have been develped and wh the develper is. WVS 5: New Features Overview WVS Versin 5 cntains a set f exciting new features including: Micrsft Windws Vista Supprt Visual Imprvements: New graphics and visuals acrss the whle applicatin. Cmpliance Reprting: This new versins ffers detailed cmpliance reprting fr OWASP, PCI, Sarbanes-Oxley, Web Applicatin Security Cnsrtium and HIPAA. Subdmain Scanner: The Subdmain scanner allws fast and easy identificatin f active Subdmains using varius techniques and guessing f cmmn subdmain names. The Subdmain Scanner can be cnfigured t use the target s DNS server, r ne specified by the user fr flexibility. Web Services Scanner: The Web Services Scanner allws yu t scan in an autmated way fr vulnerabilities in Web Services, and t generate a detailed security reprt frm the results. Web Services Editr: The Web Services Editr allws yu t imprt an nline r lcal WSDL fr custm editing and executin f varius web service peratins ver different prt types fr an in depth analysis f WSDL requests and respnses. The editr als features syntax highlighting fr all languages t easily edit SOAP headers and custmize yur wn manual attacks. Site Structure File Selectin: This much requested feature allws the selectin f individual files and flders frm the Site Structure s that yu will always be in cntrl f what t scan. Retain Settings n Upgrade: WVS will nw ask t keep yur previus cnfiguratin and settings when upgrading frm a previus build. Scanning Mde Selectin: Each scan can nw be executed in either ne f three mdes: Quick, Heuristic and Full. Each mde ffers different appraches t test a website which cmprmise between detectin rate and speed. Reprter Applicatin: The reprting features f WVS have been revamped and integrated int a separate applicatin which nw supprts reprting templates fr: develpers, executives, scan cmparisns, statistics and als cmpliance reprting. P a g e 2

3 Passwrd Prtectin: WVS and all its supprting applicatins (like the Reprter, Scheduler, Vulnerability Editr and Cmmand Line) can nw be passwrd prtected t allw access nly t authrized users. Reduced Database Size: Significantly reduced database size by 90% while keeping the same details and mre! A new database structure had t be designed t achieve this which wuld require a database upgrade frm lder WVS versin fr which a cnversin tl is available. Imprved Scheduler: The scheduler nw supprt new ways t start a scan and different utputs such as a saved scan results file r a reprt. Supprt fr Web Services scans scheduling is als included. Anther requested new feature in the sending f mail ntificatins upn scan cmpletin. New / Imprved Vulnerability Tests: Stres Crss-Site-Scripting (XSS) tests Header Manipulatin tests Imprved Blind SQL Injectin tests Imprved Md_Rewrite supprt Imprved Lgic: Autmatic detectin f Directry Recursin Lps Autmatic detectin f URL Rewrite website during a scan. Gruping f test variants Multi-Step Scanning Other Imprvements: Surce View with syntax highlighting Imprved filtering (replacing the ld search functinality) Imprved and mre granular Lgging ptins Sitemap supprt WVS Vulnerability Tests WVS autmatically crawls yur website and all its related web applicatins t scan fr the fllwing classes f vulnerabilities: Versin Check Vulnerable Web Servers Vulnerable Web Server Technlgies CGI Tester Checks fr Web Servers Prblems Verify Web Server Technlgies Get Web Server Infrmatin Authenticatin Input Validatin Authenticatin Attacks Parameter Manipulatin Crss-Site Scripting (XSS) SQL Injectin Cde Executin Directry Traversal P a g e 3

4 File Inclusin Script Surce Cde Disclsure CRLF Injectin / HTTP Respnse Splitting Crss Frame Scripting (XFS) PHP Cde Injectin XPath Injectin Full Path Disclsure LDAP Injectin Ckie Manipulatin URL Redirectin Applicatin Errr Messages MultiRequest Parameter Manipulatin Blind SQL/XPath Injectin File Checks Checks fr Backup Files r Directries Crss Site Scripting in URI Checks fr Script Errrs Directry Checks Lks fr Cmmn Files (such as lgs, traces, CVS) Discver Sensitive Files/Directries Discvers Directries with Weak Permissins Crss Site Scripting in Path and PHPSESSID Sessin Fixatin. Web Applicatins Large database f knwn vulnerabilities fr specific web applicatins such as Frums, Web Prtals, Cllabratin Platfrms, CMS Systems, E- Cmmerce Applicatins and PHP Libraries. Text Search Directry Listings Surce Cde Disclsure Check fr Cmmn Files Check fr Server Side Includes (SSI) Directives Check fr Addresses Micrsft Office Pssible Sensitive Infrmatin Lcal Path Disclsure Errr Messages Web Services Parameter Manipulatin SQL Injectin / Blind SQL Injectin Directry Traversal Cde Executin XPath Injectin Applicatin Errr Messages GHDB Ggle Hacking Database Over 1400 GHDB Search Entries in the Database Other vulnerability tests may als be perfrmed using the manual tls prvided, including: Input Validatin Authenticatin attacks Buffer verflws Thrugh the Scanning Prfile cnfiguratin, users may set WVS t scan fr all (default) r a selectin f these vulnerability classes. P a g e 4

5 Advanced Tls The Acunetix WVS bradens the scpe f vulnerability scanning by intrducing advanced and highly rigrus technlgies t tackle the cmplexities f tday's cmplex web-based envirnments. WVS allws users t scan autmatically fr knwn vulnerabilities accrding t a regularly updated database while als allwing fr ther frms f intelligent vulnerability scans thrugh manual interventin. In additin, WVS allws the user t perfrm cmprehensive autmated hacking attacks that are nt tied t particular applicatins. This allws the testing f custm applicatins irrespective f hw and when they have been develped and wh the develper is. The fllwing is a list f the mre advanced WVS tls: Target Finder: The Target Finder is a prt scanner that may be used t lcate a web site within a given range f IP addresses. Authenticatin Tester: Audit passwrd prtected pages by launching a dictinary attack with the pwerful Authenticatin Tester tl. Subdmain Scanner: The Subdmain scanner allws fast and easy identificatin f active Subdmains using varius techniques and guessing f cmmn subdmain names. The Subdmain Scanner can be cnfigured t use the target s DNS server, r ne specified by the user fr flexibility. HTTP Editr: Cnstruct HTTP/HTTPS requests and analyze the resulting web server respnses with the HTTP Editr tl. In additin, yu may perfrm custm SQL Injectin and Crss Site Scripting attacks. HTTP Sniffer: Lg, intercept and mdify all HTTP/HTTPS traffic with the HTTP Sniffer t develp a deep insight int what data yur web applicatin/s is/are sending. HTTP Fuzzer: With this tl yu can perfrm sphisticated testing fr buffer verflws and input validatin. It allws yu t mdify HTTP/HTTPS requests t include any type f generatr and send multiple queries in an autmated manner, saving a lt f time cmpared t manual testing. Web Services Scanner: The Web Services Scanner allws yu t scan in an autmated way fr vulnerabilities in Web Services, and t generate a detailed security reprt frm the results. Web Services Editr: The Web Services Editr allws yu t imprt an nline r lcal WSDL fr custm editing and executin f varius web service peratins ver different prt types fr an in depth analysis f WSDL requests and respnses. The editr als features syntax highlighting fr all languages t easily edit SOAP headers and custmize yur wn manual attacks. Reprter: The Reprter applicatin allws yu t quickly create reprts which specify all the vulnerabilities detected classifying them accrding t risk levels. Each vulnerability is presented with detailed recmmendatins n the actin yu need t take t crrect it and prevent yur site/applicatin frm being hacked. Furthermre, all scan sessins can be saved t a MS SQL Server r Access database fr yu t satisfy yur custm reprting requirements. In WVS v5 the reprting features f WVS have been revamped and integrated int a separate applicatin which nw supprts reprting templates fr: develpers, executives, scan cmparisns, statistics and als cmpliance reprting. Cmpare Results Tl: The cmpare results tl allws yu t analyze the differences between tw scans perfrmed at different dates. P a g e 5

6 Scheduler: Schedule such tasks as autmated web crawling and scanning at a time that is mst cnvenient t yu. Tasks may be run daily, weekly, mnthly, at certain times and/r cntinuusly within a queue. Cmmand Line Supprt: This can be used t launch the applicatin via the cmmand line with varius parameters. Other Features WVS cntains a hst f ther features including: Scan Wizard t simplify the scanning prcess. User agent definitin Yu can custmise hw Acunetix WVS identify itself t the server. Custm HTTP Tuning t cntrl hw fast the applicatin sends requests t a web server. Online Updates frm within the applicatin fr prduct updates and fr new vulnerabilities. By default WVS ignres multimedia files which wuld slw dwn the scan. (e.g. BMP, AVI, etc..) Site Crawler cnfiguratin with File / Directry Filters, URL Rewrite and Custm Ckies. MS Access and MS SQL Server supprt t stre the scan results. Supprt fr HTTP and SOCKS Prxy servers. SSL Client Certificates supprt. Custm Scanning Prfiles. Scanner list f allwed hsts. Lgin sequence recrder fr all types f lgins. HTML Frms custm submissin inputs. Supprt fr Custm 404 Errr Pages Custm GHDB Database filters. Applicatin lgging fr trubleshting purpses. P a g e 6