With the exponential increase in internet usage, companies around the world are now obsessed about having a web application of their own which would provide all the functionalities to their users with a single click. In this quest for providing the customers with single click solutions, all the sensitive data is shifted on to a server which is then accessed by a web application. In most of the scenarios, web applications have direct access to the backend database and thus control valuable data. With a simple well crafted malicious payload a hacker can now get all the information from database. So it’s crucial that the web applications need to be secure enough to handle the attacks.
Securing Web applications:
It’s now apparent that securing web applications is essential for the companies to be in business. The real question is how it can be achieved. Below are some of the checks that are in place to ensure that security holes in the web application are identified:
- Threat Modeling deals with identifying threats, attacks, vulnerabilities, and countermeasures for your application in the design phase.
- Security Code Reviews come into picture at the end of development phase. The entire code is inspected to find vulnerabilities.
- Manual Penetration Testing is done after the application is deployed in some environment. The application is attacked and assessed for vulnerabilities.
- Automated Vulnerability Scanners are the tools which aid Penetration testers by identifying the vulnerabilities present.
WebInspect is one of the most widely used automated vulnerability scanners in the market today. It helps us to identify vulnerabilities present in the web application by taking necessary input from us. IBM Appscan Standard Edition, Acunetix Scanner, Burp scanner, Nikto are the other vulnerability scanners that are in place. For the rest of this article I will be focusing on using WebInspect to identify security vulnerabilities.
WebInspect is a web application security scanning tool offered by HP. It helps the security professionals to assess the potential security flaws in the web application. WebInspect is basically a dynamic black box testing tool which detects the vulnerabilities by actually performing the attack. After initiating the scan on a web application, there are assessment agents that work on different areas of the application. They report their results to security engine which evaluates the results. It uses Audit engines to attack the application and determine the vulnerabilities. At the end of the scan you can generate a report called ‘Vulnerability Assessment Report’ which would list the security issues in desired format. Using this report, client can fix the issues and then go for validation scanning to confirm the same. HP WebInspect is a commercial tool and you need license to scan a web site. With the trail version you will be permitted to scan only zero.webappsecurity.com (HP demo site). So WebInspect basically comes into picture when the application is hosted in some environment (test/QA/production). As with every other tool there are both advantages and disadvantages associated with using WebInspect.
- Saves time when dealing with large enterprise applications
- Simulates the attack, shows the results and presents you with a comprehensive view.
- It is not dependent on the underlying language.
- It’s hard for any tool to find logical flaws, weak cryptographic storage, severity of the disclosed information etc.
- It has a list of payloads that it uses on every web application. It does not use any wisdom in generating payloads depending on the type of application.
- There could be false positives among the listed vulnerabilities.
Having said that, WebInspect scores high on many features and helps a great deal in providing scanning solutions.
Main Features in WebInspect 19.10:
WebInspect 9.10 is the latest version in use as of today. Below lines would throw an insight into various features that are available in WebInspect.
- Presents you with tree structure: By crawling the entire application WebInspect presents you with the hierarchical tree structure of the web application and lists all the available URLS.
- Customizable Views: While viewing the results of a scan WebInspect offers different views as per your requirement.
- Scanning Policies: WebInspect gives you the freedom to edit and customize the scanning policies to suit your requirements and thus offers great flexibility.
- Manual Hacking Control: With this option you can actually simulate an attack environment and see what’s really going on during a particular attack.
- Report Generation: You can generate customizable reports by including desired sections and in desired format.
- Remediation: WebInspect would provide a summary and the necessary fixes required to fix the vulnerabilities detected during a particular scan.
- Web Services Scan: Web services usage is growing at a rapid pace. You can assess web service vulnerabilities by using WebInspect.
- Tools: There are lot many tools that come with WebInspect like web proxy, SQL Injector, web fuzzer, web macro recorder etc.
We will now move into the actual scanning part and will explore the tool and its features.