the-web-application-hackers-handbook

764 Chapter 20 n A Web Application Hacker’s Toolkit
Web Vulnerability Scanners
Some integrated testing suites include functions to scan for common web application
vulnerabilities. The scanning that is performed falls into two categories:
n Passive scanning involves monitoring the requests and responses passing
through the local proxy to identify vulnerabilities such as cleartext password
submission, cookie misconfiguration, and cross-domain Referer leakage.
You can perform this type of scanning noninvasively with any application
that you visit with your browser. This feature is often useful when
scoping out a penetration testing engagement. It gives you a feel for the
application’s security posture in relation to these kinds of vulnerabilities.
n Active scanning involves sending new requests to the target application
to probe for vulnerabilities such as cross-site scripting, HTTP header
injection, and file path traversal. Like any other active testing, this type
of scanning is potentially dangerous and should be carried out only with
the consent of the application owner.
The vulnerability scanners included within testing suites are more userdriven
than the standalone scanners discussed later in this chapter. Instead of
just providing a start URL and leaving the scanner to crawl and test the application,
the user can guide the scanner around the application, control precisely
which requests are scanned, and receive real-time feedback about individual
requests. Here are some typical ways to use the scanning function within an
integrated testing suite:
n After manually mapping an application’s contents, you can select interesting
areas of functionality within the site map and send these to be scanned.
This lets you target your available time into scanning the most critical
areas and receive the results from these areas more quickly.
n When manually testing individual requests, you can supplement your
efforts by scanning each specific request as you are testing it. This gives
you nearly instant feedback about common vulnerabilities for that request,
which can guide and optimize your manual testing.
n You can use the automated spidering tool to crawl the entire application
and then scan all the discovered content. This emulates the basic behavior
of a standalone web scanner.
n In Burp Suite, you can enable live scanning as you browse. This lets you
guide the scanner’s coverage using your browser and receive quick feedback
about each request you make, without needing to manually identify
the requests you want to scan. Figure 20-10 shows the results of a live
scanning exercise.