Web application assessment based on intelligent generation of attack strings
A web application is more efficiently analyzed by intelligently generating attack sequences to be used in the assessment. Rather than simply sending a canned list of static strings at a web application, the operation of the web application is analyzed to determine the filtering and acceptance characteristics of the web site. As this information is ascertained, a vocabulary of allowed symbols is created. This vocabulary is used in the building of attack strings and as such, the number of attack strings fired at the web application is greatly reduced, as well as the number of false positives.
1. A method for conducting a web application vulnerability assessment, the method comprising the steps of:
conducting, using a processor, a crawl of a web application to identify input fields;
identifying a domain of symbols that can be used as input for the input fields of the web application;
determining which of the symbols are filtered and which are accepted by the web application;
building a vocabulary comprising the symbols that are accepted by the web application;
generating one or more attack strings based at least in part on the vocabulary;
sending the attack strings to the web application; and
identifying vulnerabilities uncovered by the step of sending the attack strings.
2. The method of claim 1 , wherein a database of static attack strings is provided and the step of generating one or more attack strings further comprises selecting attack strings from the static attack stings that are constructed with symbols in the vocabulary.
3. The method of claim 1 , wherein the step of determining which symbols are filtered and which are echoed by the web application further comprises the steps of:
creating a first string, the first string containing one or more symbols;
sending the first string as input to the web application;
receiving a response from the web application; and
analyzing the response to identify symbols that are echoed and filtered by the web application.
4. The method of claim 3 , further comprising the steps of:
generating a next string, the next string containing one or more symbols that have not already been determined to be filtered symbols;
sending the next string as input to the web application;
receiving a response from the web application;
analyzing the response to identify symbols that are echoed and filtered by the web application; and
continuing at the generating step until all symbols have been identified as echoed or filtered.
5. The method of claim 4 , wherein the step of generating one or more attack strings based at least in part on the vocabulary may be the same step as the step of generating a next string.
6. The method of claim 4 , wherein the step of generating one or more attack strings based at least in part on the vocabulary does not occur until the vocabulary has been completely built.
7. A method for conducting a web application vulnerability assessment, the method comprising the steps of:
determining, using a processor, which symbols of a domain of available symbols are filtered and which symbols are accepted by an input server of a web application;
building a vocabulary consisting of the symbols that are accepted by the web application;
generating one or more attack strings based at least in part on the vocabulary; and
assessing vulnerability of the web application by using the attack strings.
8. The method of claim 7 , wherein the domain of available symbols is the constructs of the markup language used to generate the web pages of the web application, and the step of determining which of the symbols are filtered and which are accepted by the input server of the web application comprises the steps of:
sending one or more of the symbols in a probe to the web application;
receiving a response from the web application that includes an echo of one or more of the symbols in the probe; and
analyzing the response to identify which symbols were echoed back.
9. The method of claim 7 , wherein the step of generating one or more attack strings based at least in part on the vocabulary further comprises building attack strings using constructs of the markup language that are included in the vocabulary.
10. The method of claim 7 , wherein the domain of available symbols is the constructs of the attack technique being employed, and the step of determining which of the symbols are filtered and which are accepted by the input server of the web application comprises the steps of:
sending one or more of the symbols in a probe to the web application;
receiving a response from the web application indicating whether the probe was accepted or rejected;
applying an algorithm to separate out the one or more symbols in the probe to send further probes and thereby isolate the symbols invoking the rejection.