So two things here... it is not uncommon with AJAX to have
the URL seeded with a something unique like a time/date stamp
to prevent caching issues, and then obviously if that is
part of the path almost any scanner will go into infinite
loop (or simply choke), if they get that far at all.
SPI's 5.5 release changed their parsing ability significantly;
we had a client with AJAX and *heavy* client side javascript
that *no* tool could parse, until WI 5.5, which managed to
crawl all (most? memory isn't great, heh) the dynamic links
etc, but still didn't find anything.
WI 5.8 has gotten better. Watchfire isn't bad either. I just
tested about 15 tools on a number of different apps and was
surprised at how many tools still made basic mistakes in "automated"
mode (parse 302 DOM body for one example) or had pretty limited
crawling abilities, and rely heavily on static URL 'guessing'.
In these cases most tools allow you to manually crawl through
and then they run their *tests*. I've had varying results with
the different vendors 'manual' modes, try for yourself, YMMV.
Like any new market, these tools are improving, and several vendors
appear to be going in the right direction, but they are far from
mature or complete solutions and the complexity of apps in the
wild seems to scale just ahead of the pace the scanners can keep
up. Take all the new rich-client/RCP over HTTP stuff, like FLEX
and Eclipse-based clients, and we're starting to see a lot of
that but I don't see anything in the automated scanner realm
that can do much here (yet, today).
-ae
-----Original Message-----
From: Tate Hansen [mailto:tate@clearnetsec.com]
Sent: Tuesday, March 28, 2006 2:29 AM
To: rajeshdilli@yahoo.com
Cc: webappsec@securityfocus.com
Subject: RE: AJAX and Web application scanners
One of the keywords there to watch is 'parsers'. This chart by Secure
Enterprise a few months ago reports all scanners 'parse' JavaScript:
http://i.cmpnet.com/secureenterprisemag/0209/graphics/0209f1a.gif
My experience is the same; these scanners fail to fully crawl
an application
which "builds" URLs dynamically.
From my understanding (I may be wrong) what most of these
products do is
search for static URL paths like http://www.mysite.com. In order to
automate crawling, execution is required, not just parsing.
For example, if
JavaScript is used to generate a URL like: window.location =
"http://www.mysite.com?tracking="; +
getelementbyname(element_name).value;,
then these scanners will miss it. Obviously you can miss a
lot depending on
what is dynamic and how you can interact with those views.
The work-around is you must manually crawl the web
application in order to
seed the scanners with the dynamic views (I've also heard
this confirmed by
engineers whom work for these vendors).
A month or so ago I viewed a README note for the latest
WebInspect version
which reports: Support for Advanced Asynchronous JavaScript
and XML (AJAX)
Applications / Improvements to the JavaScript and Audit
engines now allow
WebInspect to crawl and audit AJAX-based applications. I'm
not sure what
that exactly means, but I think all the major players are
adding some type
of execution capabilities.
Tate Hansen
ClearNet Security
-----Original Message-----
From: rajeshdilli@yahoo.com [mailto:rajeshdilli@yahoo.com]
Sent: Monday, March 27, 2006 1:12 PM
To: webappsec@securityfocus.com
Subject: AJAX and Web application scanners
Hi,
I've been recently going around the web for a
couple of challenges
that AJAX faces. One thing that struck me was the web
application scanners.
I've seen a few vendors (i don't to mention any vendor or
product name here)
products that claim that they have javascript parsers and
support for AJAX
driven applications. My personal experience with these tools
is that they
could not spare well against apps that are heavily JavaScript
driven and
with the introduction of AJAX based apps it's a case of
uncertainity in
choosing the right product (if at all there can be one which
can progress in
auditing AJAX applications). Do any of you have any insights
or experinces
on these tools against AJAX based apps.
Thanks
Rajesh
--------------------------------------------------------------
-----------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=7013
00000003gRl
--------------------------------------------------------------------------
-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
