the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 773
Figure 20-16: TamperIE lets you modify HTTP request details
within Internet Explorer
Standalone Vulnerability Scanners
A number of different tools exist for performing completely automated vulnerability
scans of web applications. These scanners have the benefit of being able
to test a large amount of functionality in a relatively short time. In a typical
application they often can identify a variety of important vulnerabilities.
Standalone web application vulnerability scanners automate several of the
techniques we have described in this book, including application spidering,
discovery of default and common content, and probing for common vulnerabilities.
Having mapped the application’s content, the scanner works through
its functionality, submitting a range of test strings within each parameter
of each request, and analyzes the application’s responses for signatures of
common vulnerabilities. The scanner produces a report describing each of
the vulnerabilities it has discovered. This report usually includes the specific
request and response that the application used to diagnose each reported
vulnerability, enabling a knowledgeable user to manually investigate and
confirm the bug’s existence.
A key requirement when you are deciding whether and when to use a
vulnerability scanner is to understand the inherent strengths and weaknesses
of these types of tools and the challenges that need to be addressed
in the course of developing them. These considerations also affect how you
can effectively make use of an automated scanner and how to interpret and
rely on its results.