Web application scanners crawl a web application to locate vulnerabilities by simulating attacks. They work by supporting various protocols, crawling and parsing content, testing for vulnerabilities, and generating reports. While scanners help find issues, developers should focus on learning secure coding practices to build applications securely from the start.

1. How web application scanners
Work
Future University Computer Science Open Day
August 2016

2. Who Am I
 TGy aldeen abdalmoniem
 Software Engineer / InfoSec researcher.
 Interested in machine learning usage in intrusion detection systems and
IOT security.
If any one interested, please contact me.
Contact:
http://tagy.sd
tagy-aldeen@hotmail.com

3. OWASP …
... and OWASP
Khartoum.

4. Around the world

5. OWASP is not
L33t haxorzing
Private
0day
Private
forums
Mad 0wnag3
sk1lz

6. Top 10 Web
Dev. Guides
Design Guides
Testing Guides
WebGoat
WebScarab
ZAP
ESAPI
Browser Security
Industry Sectors
Access Control
Education
Local Chapters
Conferences
Tutorials
Mailing Lists
Documentation Tools Groups Community

7. Wanna join?
Join our community (free cookies?)
Share and learn.
Attend meetings and sessions.
Push us to do better.
Become a member?

8. Content
 Introduction.
 Who is this for.
 Why should we use it.
 How magic really happen?
 Scan Steps.
 Code Samples.
 Advice and References.
 Questions.

9. Introduction
What is Web application scanner !!
• Briefly, these tools crawl a web application and locate application layer vulnerabilities
and weaknesses, either by manipulating HTTP messages or by inspecting them for
suspicious attributes.
• In other words: the scanner search the application for vulnerabilities by simulating
attacks on it.
• So it is software that detects security weaknesses and vulnerabilities.

10. Who Is this for !
Software engineers interested in developing Security applications.
Web application Developers.
On the other Hand:
Software Testers.
Quality assurance section in companies.
Penetration Testers.

11. Small note
The aim of this session is not to define a list of scanners, and evaluating
specific products.
Goals
Provide scanner users with a reference that can be used to conduct a thorough scanner
evaluation and make an informed decision.
Provide scanner developers with a list of capabilities to compare their tools against to
help them create a roadmap of future enhancements

12. Why should we use scanner !
o First of all Network Firewalls, SSL and locked-down servers can’t
stop your web applications and websites from being hacked.
Any note on this !
o Do you grantee your code is secure !
o Do you know how to write secure code !
o Web application scanners help reduce the number of vulnerabilities
in web applications.
o Scanners are an important part of most application security
programs.

13. Steps of the scan:
1. Protocol support
2. Crawling
3. Parsing
4. Testing
5. Command and Control
6. Reporting

14. Protocol Support & Authentication
Check the protocol support list of the scanner and verify that SSL/TLS, required
HTTP versions, HTTP compression.
Check the ability of the scanner to keep the connections open for multiple requests.
o What types of authentication are used by the application you’ll be scanning?
o HTML form-based.
o Login process that can’t be fully automated ( CAPTCHA).
Authentication:

15. Crawl and coverage
 Ensure that representation of your web application includes
Files.
Scripts.
Client scripts.
Input parameters.
Directories etc…
 If not all objects are listed, it means that the crawler is not able to
automatically crawl all of the web application, thus might not
identify all vulnerabilities.

16. Crawling procedure
o Scanner must first find the page in order to find the
vulnerability!
o How well does the scanner support redirects? AJAX?
o Lots of details in this section for developers who would
like to improve their scanners!

17. Scanner view of the pages:
The web scanner Track links by searching for <a href > tags

19. Parsing
Some of it can be done through manual training of the scanner but the
intelligence of the tool depends on the ability to parse web content of
the application.
What Content is supported
The essential web content types that the scanner should be able to
parse are HTML, JavaScript, VBScript, XML, Plaintext, ActiveX
Objects, Java Applets, Flash, CSS, and many more.

20. How parser see the page !

21. Parsing
The web scanner will submit this form and start testing the form inputs with various payloads
looking for vulnerabilities.

22. Command, Control
 The primary factors to be considered here are as follows:
 Ability to schedule scans
 Ability to Pause and resume scans
 Ability to view real time scan status
 Ability to define re-usable configurable templates
 Multi user and multi scan support

23. Testing and Reporting
 A scanner should allow configurations to include/exclude/set URL, file
extensions, parameters, host names/IP, cookies and http headers.
 It should be able to identify vulnerabilities, architectural weaknesses,
authorization and authentication related problems.

24. Report Sample

25. Vulnerability Example
The scanners assess a target application by constructing HTTP or HTTPS requests
that are known to elicit a response indicating susceptibility to various types of
attack.
POST /bank/search.aspx HTTP/1.0<br> Host: www.acme-hackme.com rn ...rn
searchterms=<script>alert('xss')</script> "/%20<script>alert('css')</script>%20.shtml"
If the response contains the submitted "searchterms" parameter value in the
exact format it was submitted, then the input value is vulnerable to cross-site
scripting.

26. SQl Injection Example

27. Detecting DB
Stander Error message

28. Sample From B3ati
1
3
4
3
2

29. Advice for a Scanner Evaluation
Obtain latest version of each scanner.
For commercial scanners, contact vendor for free trial.
Don’t download old versions off of PirateBay!

30. References:
 For Developers and Testers
o https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools
o Securitytube.net
o Nikto By Linux CBT
 For Software engineers
o Python Scripting Expert (Security Tube)
o Wa3f
o Vega (open source) for java developers.
o B3ati (written by me)
o https://github.com/TGyAlDeen/B3ati.
Contribute if you can, believe me you can (wa3f report) and many more .

31. Summary
o Scanners will help you to find vulnerabilities in your applications, But why even
vulnerability can be found!!
o Learn how to write secure application from scratch.
o Use WAF, check mazin paper for more information.

32. Questions !