Trinity vulnerability analysis method-web Application Security Testing Method

Trinity vulnerability analysis method-web Application Security Testing Method
0x00 preface 4.1 active (fully automated): Web2.0, interactive vulnerability scan 4.2 semi-automatic vulnerability analysis: Business replay, url image, 4.3 high coverage passive vulnerability analysis: active (automatic) Web scanning for 0x01 0-day and island pages

• Use common vulnerability scanners • Automatic fuzz to fill in various types of aggressive Data • business logic obfuscation, resulting in service errors

• Limitations: • difficult to handle highly interactive applications • only links exposed to users (search engines) can be found, and 100% of business links cannot be covered • solution: introduction of semi-passive Vulnerability Analysis Methods • more than 50% of Web application systems have high-risk vulnerabilities without human intervention

0x02 semi-automatic vulnerability analysis: Service replay + url image for high coverage 1. Method 1: burpsuite, fiddler:
HTTP (S) business traffic recording and replay scanning manual modification of business data streams is also applicable to mobile apps

Detection logic vulnerability: • Horizontal access bypass • order modification • hidden domain Modification

2. Method 2: manually record

• Retrieve url records from logs

1. Fiddler Url log 2. Obtain the access logs of Apache, Nginx, and Tomcat 3. Extract the url logs from the bypass image (security personnel no longer need to wait for the application to go online)

Export Url logs from Fiddler2 and burpsuite and then import them to vulnerability scan

2. obtain access logs for Apache, Nginx, and Tomcat

360-logstore Splunk various log audit systems
Extract url logs from bypass images (security personnel no longer need to wait for application launch notifications) such as jnstnifer, 360 eagleeye, and major IT companies

 

• Retrieve the url list from the bypass image to efficiently detect a large number of vulnerabilities. Without the notification from the O & M personnel, you can know the launch status of the Business System and execute the vulnerability scan task.

0x03 semi-automatic vulnerability analysis: Service replay, url image, and high coverage

-Restrictions ① Time Lag/token: When traffic is resold, 100% may not be able to reproduce the current business process and bugs. ② It is still difficult to cover 100% of business links, and there are island pages. (NORMAL Data streams are not triggered) ③ Vulnerability Detection (Defense) technology lags behind attack technology and cannot solve 0-day vulnerabilities-solution: introducing full passive Vulnerability Analysis

0x04 full passive vulnerability analysis:

Foreign products: Nessus PVS passive Scan

Full passive vulnerability analysis (no data packet is sent) Full passive scan VS active vulnerability scanner share the same point: Both determine whether the vulnerability is different based on the content of two-way data packets: detection method: passive scanning does not need to be connected to the Internet, and does not send url requests or send any data packets. The difference between PVS and IDS is: • focus more on Vulnerability awareness rather than intrusion. For example, an SQL error message appears on the page, you can trigger pvs alarms, but do not trigger ids alarms. • Different alarm results: pvs generates alerts based on the vulnerability risk level and ids Based on hacker attack techniques • Two-way analysis of data packets • more focus on web applications, OWASP top 10 attack means • alert by attack impact (Analysis of Two-way packets), rather than warning by attack means (Analysis of One-Way packets) Nessus PVS is just one idea, it focuses on network and host vulnerabilities and has limited Web application detection capabilities. It needs to re-design a web-targeted PVS: WebPVS, and synchronously accept all business requests submitted by users, the scan engine identifies a request. Once a malicious request is found or the request returns data, an alarm is triggered.

• Advantages of WebPVS: • although it is still difficult to cover 100% of business links, it can cover 100% of existing business links. • Various vulnerabilities can be detected simultaneously with hackers • 0-day attacks can be detected based on the returned packet because the HTTP protocol is fixed.