Gray-box web Security Detection Technology

Gray-box web Security Detection Technology

In traditional application testing methods, gray-box testing is between white-box testing and black-box testing. Gray-box web Security Detection still follows the concept of gray-box testing, but only focuses on the security part of code implementation. Most of the security issues or security vulnerabilities at the web application code level come from external input. The execution of key functions in the Code business logic is not safely handled, and security issues or security vulnerabilities are formed.

 

Limitations of black box and white box Security Testing

 

Black box limitationsFor example, traditional web security scanner.

 

Extremely high vulnerability false negative rate---- In the Post-web era, The crawler engine of Traditional scanners cannot cover the vast majority of business logic due to the complexity of application business logic functions or verification scenarios with complex permissions, resulting in a large number of false positives.

 

 

Performance and Efficiency---- For different vulnerability scenarios of the same vulnerability type, an additional authentication policy may be required. After long-term accumulation, a large amount of redundancy and testing time will also increase, resulting in low performance and efficiency of the scanner.

 

High false positive rate of Vulnerabilities---- Uncontrollable factors such as network environment, scanner performance, and Policy defects may cause a large number of false positives.

 

Limitations of white boxFor example, common code audit tools.

 

 

 

Low detection efficiency---- For large web applications, there are no longer thousands of lines of code, which may be dozens or millions of lines of code, both the efficiency of audit tools and the efficiency of vulnerability verification are low.

 

Difficult to cover code scenarios---- For increasingly complex code implementation scenarios, a large number of open-source projects, especially package code, how can we predict the implementation code of a programmer by strategy? It is difficult to cover a large number of vulnerability scenarios.

 

Low vulnerability Accuracy---- For the implementation code with secure processing, it is not accurate to determine a vulnerability based on policies because the Code cannot be run in a pure white box. A lot of redundant work is also done to reduce the efficiency.

 

 

New trends in web security testing based on gray boxes

 

 

At present, companies such as Hewlett-Packard and IBM have begun to implement gray-box security testing, and such products or tools have not yet appeared in China. It shows high-efficiency testing, high service logic coverage, and high vulnerability accuracy.

 

The gray-box Security Test balances the black and white-box security tests and places the tests on the business logic layer of the application function. It can basically cover all the business logic of the application, with few policies, far lower than black box and white box testing. The detection results are extremely accurate. At least key functions can be contaminated from external parameters, resulting in security problems and security vulnerabilities. The implementation of the gray-box testing tool can improve the test efficiency and meet the security testing requirements of complex applications. More importantly, it standardizes code security, corrects programmer code errors from the root cause of the vulnerability, and forms a security coding baseline. now and in the future, it is imperative to choose a gray-box security test.

 

J2EE gray-Box Detection and Version Control Platform beta version

 

 

 

Anheng information has begun to implement the gray-box security testing tool, leading the domestic web-based gray-box security testing. The J2EE gray-Box Detection and Version Control Platform demo is in beta testing. Common Code-level vulnerability types are detected: reflected XSS, stored XSS, SQL injection, file inclusion, system command injection, secure directory bypass, OGNL expression injection, and URL redirection.

 

 

Create a test project:

 

 

Create version:

 

Select active or passive mode:

 

Passive mode, with a higher business logic coverage rate:

 

 

Vulnerability results allow testers and developers to quickly and accurately verify Vulnerabilities

According to the internal test results, the comprehensive effect of gray-box security testing is far greater than that of traditional black-box and white-box code audit tools, especially in reflective XSS, storage-type XSS, and SQL injection and other vulnerability types have better performance. In the same test on open-source projects in China and abroad, after testing the application deployment, a large number of high-risk 0-day vulnerabilities can be quickly detected within a few minutes. The gray-box Security Detection solves common security vulnerabilities in the development language at the code level.