Dynamic application security testing

A dynamic application security testing (DAST) is a non functional testing process where one can assess an application using certain techniques and the end result of such testing process covers security weaknesses and vulnerabilities present in an application. This testing process can be carried out either in manual way or by using automated tools. Manual assessment of an application involves a more human intervention to identify the security flaws which might slip from an automated tool. Usually business logic errors, race condition checks, and certain zero day vulnerabilities can only be identified using manual assessments.

On the other side, a DAST tool is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses.[1] It performs a black-box test. Unlike static application security testing tools, DAST tools do not have access to the source code and therefore detect vulnerabilities by actually performing attacks.

DAST tools allow sophisticated scans, detecting vulnerabilities with minimal user interactions once configured with host name, crawling parameters and authentication credentials. These tools will attempt to detect vulnerabilities in query strings, headers, fragments, verbs (GET/POST/PUT) and DOM injection.

Overview

DAST tools facilitate the automated review of a web application with the express purpose of discovering security vulnerabilities and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, such as input/output validation: (e.g. cross-site scripting and SQL injection), specific application problems and server configuration mistakes.

In a copyrighted report published in March 2012 by security vendor Cenzic, the most common application vulnerabilities in recently tested applications include:[2]

37%Cross-site scripting
16%SQL injection
5%Path disclosure
5%Denial-of-service
4%Code execution
4%Memory corruption
4%Cross-site request forgery
3%Information disclosure
3%Arbitrary file
2%Local file inclusion
1%Remote file inclusion
1%Buffer overflow
15%Other (PHP injection, Javascript injection, etc.)

Commercial and open-source scanners

Commercial scanners are a category of web-assessment tools which need to be purchased. Some scanners include some free features but most need to be bought for full access to the tool's power.

Open-source scanners are often free of cost to the user.

Security researcher Shay Chen has previously compiled an exhaustive list of both commercial and open-source web application security scanners.[3] The list also highlights how each of the scanners performed during his benchmarking tests against the Web Application Vulnerability Scanner Evaluation Project (WAVSEP).

The WAVSEP platform is publicly available and can be used to evaluate the various aspects of web application scanners: technology support, performance, accuracy, coverage and result consistency.[4]

DAST strengths

These tools can detect vulnerabilities of the finalized release candidate versions prior to shipping. Scanners simulate a malicious user by attacking and probing, identifying results which are not part of the expected result set, allowing for a realistic attack simulation.[5] The big advantage of these types of tools are that they can scan year-round to be constantly searching for vulnerabilities. With new vulnerabilities being discovered regularly this allows companies to find and patch vulnerabilities before they can become exploited.[6]

As a dynamic testing tool, web scanners are not language-dependent. A web application scanner is able to scan engine-driven web applications. Attackers use the same tools, so if the tools can find a vulnerability, so can attackers.[7]

DAST weaknesses

While scanning with a DAST tool, data may be overwritten or malicious payloads injected into the subject site. Sites should be scanned in a production-like but non-production environment to ensure accurate results while protecting the data in the production environment.

Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself. The penetration tester should look at the coverage of the web application or of its attack surface to know if the tool was configured correctly or was able to understand the web application.

The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have a predefined list of attacks and do not generate the attack payloads depending on the tested web application. Some tools are also quite limited in their understanding of the behavior of applications with dynamic content such as JavaScript and Flash.

A report from 2012 found that the top application technologies overlooked by most Web application scanners includes jQuery, REST, and Google WebToolkit in AJAX applications, Flash Remoting (AMF) and HTML5, as well as mobile apps and Web Services using JSON and REST. XML-RPC and SOAP technologies used in Web services, and complex workflows such as shopping cart, and XSRF/CSRF tokens.[8] [9]

References
  1. Web Application Security Scanner Evaluation Criteria version 1.0, WASC, 2009
  2. "2012 Trends Report: Application Security Risks". Cenzic, Inc. 11 March 2012. Archived from the original on 17 December 2012. Retrieved 9 July 2012.
  3. Comparison of Cloud & On-Premises Web Application Security Scanning Solutions. SecToolMarket.com Retrieved 2017-03-17
  4. WAVSEP Platform Retrieved 2017-03-17
  5. "SAST vs DAST". G2 Research Hub. Archived from the original on 2020-05-03.
  6. "The Importance of Regular Vulnerability Scanning". AppCheck Ltd. Archived from the original on 2020-08-06.
  7. Bashvitz, Gadi. "DAST Pros and Cons". Bright Security. Retrieved 2023-03-21.
  8. Web Application Scanners Challenged By Modern Web Technologies. SecurityWeek.Com (2012-10-25). Retrieved on 2014-06-10.
  9. Web Application Security Testing Retrieved 2020-11-04
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.