MatriXay DAS-WEBScan MatriXay WEB Application Vulnerability Scanner V 5.0 (DAS- WEBScan ) - - - - - The best WEB application assessment tool 1. Overview MatriXay DAS- Webscan is a specific application security assessment tool to help customers to understand security risks in Web application, set up reliable security service and provide the protection against web attacks, including injection attacks, XSS, phishing attacks, information leakage, malicious code, form bypass, buffer overflow. DAS- Webscan is compliant with many regulations, such as SOX, PCI. Figure1:Product interface Copyright DBAPPSecurity Ltd All Right Reserved Page 1/7
MatriXay DAS-WEBScan 2. Function In- depth Scan: In- depth scan focuses on WEB vulnerability risks. Support various WEB application programs, including WEB2.0, JAVAScript, FLASH WEB Vulnerability Detection: Rich policy library bases on web vulnerability detection, including SQL injection, Cookie injection, XPath injection, LDAP injection, XSS, code injection, form bypass, weak password, sensitive information and directory, management background. Web Trojan Detection: Automatically detect web Trojan with hang horse and precisely analyze virus types transited by web Trojan. Configuration Audit: Get sensitive information from database through existing vulnerabilities and audit background data, such as weak password, misconfiguration. Penetration Testing Simulate hacker attacking through existing vulnerabilities and deeply analyze WEB application security. Execute harmless attack to get direct forensic threatening system security. Figure2: Penetration Testing Copyright DBAPPSecurity Ltd All Right Reserved Page 2/7
3. Features Deeply and precisely evaluate Web application vulnerabilities to enhance defense ability. Support Web application types: WEB 2.0, various JavaScript analysis FLASH analysis WAP and WMLScript systems Detection upon HTTPS application system Known well Web application vulnerabilities Entire dynamic pages WEB application system upon HTTP1.0 and HTTP1.1 protocol Support various authentication methods: Basic, Digest, NTLM HTTP and SOCKS proxy Database types available: Oracle MSSQL DB2 Informix Sybase Mysql PostgreSQL Access Ingres Vulnerabilities available (including OWASP top 10): SQL injection XSS CSRF Web Trojan Hidden Field Form Bypass AJAX Injection Misconfiguration Sensitive Information Leakage HI- JACK attack Weak Password Xpath injection LDAP injection Frame Injection Operation system command injection Flash source code leakage Flash cross- site attack Cookie injection Sensitive information Third party software Other CGI vulnerabilities Flexibly setting scan modes: Normal scan, command scan available Support scanning modes: crawl and test, test after crawl, crawl only, test only Scan Modes: Single domain, Multiple domains Copyright DBAPPSecurity Ltd All Right Reserved Page 3 / 7
Scan range: Existing URL, Existing sub- domain, Existing domain, Arbitrary URL Support fully automatic scan without any operator Operation Modes: Active scan and passive scan (Proxy) Scan depth: Support unlimited- depth scan The process of scanning enables on/off at any time. Real- time scan result storage Support scan for multiple tasks, multiple threads, multiple engines Support scan exception sitting Support encryption management of scan files Support importing /exporting configuration file In- depth intelligent engine scan SSL available Automatic skipping duplicated pages Automatic detection of entire parameters Available for Case sensitive /no case sensitive in webpage Available to set entire detection modes Record function of authentication code available Unique forensic mode to ensure the precision of result Visible and rich statistics reports Entire trend analysis Rich risk assessment reports available to export it with different formats or customization Horizontal /vertical comparison of scan result available System running available without supporting from the third party software Copyright DBAPPSecurity Ltd All Right Reserved Page 4 / 7
Table 1 Common WEB application analysis of attack affections Vulnerability Description Type SQL Injection Cookie Injection Database information theft, tampering, deletion Database information theft, tampering, deletion. Control server XSS Buffer Overflow Form Bypass Files upload Stolen user credential, web and users information, Capture and control server Attackers to access directories without privilege Tampered home page, compromised data and Trojan transportation Included Files Server information theft. Capture and control server Web Trojans Directly control web hosting or use it to attack users Figure3: Scan Result Chart Copyright DBAPPSecurity Ltd All Right Reserved Page 5 / 7
Copyright DBAPPSecurity Ltd All Right Reserved Page 6 / 7
4. Application Common security problems Rather than just focus on network server, hackers launched more attacks to web application gradually. Entire business systems, including CBOSS, BBOSS utilizes B/S structure to increase security risks Existing vulnerabilities in WEB application are found after it is attacked. How to find WEB application vulnerabilities actively before hackers attack it. DBAPPSecurity solutions: Active defense- - - - Ensure application security from technology and management Utilize DAS- Webscan tool to set the WEB application security platform Make WEB application vulnerability scan and risk assessment as regular operation procedure Periodically inspect WEB application self security and reliability connecting outside site Periodical Training: Training in hacking technology, security defense technology, encode regulation Copyright DBAPPSecurity Ltd All Right Reserved Page 7 / 7