the-web-application-hackers-handbook

776 Chapter 20 n A Web Application Hacker’s Toolkit
Within the previous two listings of vulnerabilities, each list contains defects
that may be classified as low-hanging fruit — those that can be easily detected
and exploited by an attacker with modest skills. Hence, although an automated
scanner will often detect a decent proportion of the low-hanging fruit within
an application, it will also typically miss a significant number of these problems
— including some low-hanging fruit that any manual attack would detect!
Getting a clean bill of health from an automated scanner never provides any
solid assurance that the application does not contain some serious vulnerabilities
that can be easily found and exploited.
It is also fair to say that in the more security-critical applications that currently
exist, which have been subjected to more stringent security requirements
and testing, the vulnerabilities that remain tend to be those appearing on the
second list, rather than the first.
Inherent Limitations of Scanners
The best vulnerability scanners on the market were designed and implemented
by experts who have given serious thought to the possible ways in which all
kinds of web application vulnerabilities can be detected. It is no accident that
the resulting scanners remain unable to reliably detect many categories of vulnerabilities.
A fully automated approach to web application testing presents
various inherent barriers. These barriers can be effectively addressed only by
systems with full-blown artificial intelligence engines, going far beyond the
capabilities of today’s scanners.
Every Web Application Is Different
Web applications differ starkly from the domain of networks and infrastructures,
in which a typical installation employs off-the-shelf products in more
or less standard configurations. In the case of network infrastructure, it is
possible in principle to construct in advance a database of all possible targets
and create a tool to probe for every associated defect. This is not possible
with customized web applications, so any effective scanner must expect the
unexpected.
Scanners Operate on Syntax
Computers can easily analyze the syntactic content of application responses
and can recognize common error messages, HTTP status codes, and usersupplied
data being copied into web pages. However, today’s scanners cannot
understand the semantic meaning of this content, nor can they make normative
judgments on the basis of this meaning. For example, in a function that
updates a shopping cart, a scanner simply sees numerous parameters being