Install runtime agent for security test
Example embodiments disclosed herein relate to an approach for installing a runtime agent during a security test. A security test is initiated or performed on an application under test executing on a server. An application vulnerability associated with the application under test is determined. The application vulnerability is exploited to install the runtime agent on the server. The security test is continued using the runtime agent to receive additional information about the application under test.
1. A non-transitory machine-readable storage medium storing instructions that, if executed by at least one processor of a device, cause the device to:
initiate a security test on an application under test (AUT) to execute at a server;
determine an application vulnerability associated with the AUT;
determine a first framework used at the server and associated with the AUT;
select a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
exploit the application vulnerability to install the first runtime agent on the server, the exploiting comprising providing a script to the AUT via the application vulnerability to cause download of the first runtime agent, and unpacking the first runtime agent for the installation at the server;
restart the AUT prior to a continuation of the security test and after the installation of the first runtime agent; and
continue the security test using the first runtime agent to receive additional information about the AUT.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the first runtime agent is used to provide the additional information about internal operations performed by the AUT.
3. The non-transitory machine-readable storage medium of claim 1 , wherein the determined application vulnerability comprises a vulnerability of the AUT to injection of code onto the server via the AUT.
4. The non-transitory machine-readable storage medium of claim 1 , further comprising instructions that if executed cause the device to:
add a header to an application request sent to the AUT, the header comprising information useable by the first runtime agent to diagnose the application vulnerability.
5. The non-transitory machine-readable storage medium of claim 4 , wherein the header further comprise a payload used by the device in an attack of the AUT as part of the security test.
6. The non-transitory machine-readable storage medium of claim 4 , further comprising instructions that if executed cause the device to:
receive information from the first runtime agent responsive to the header, the received information comprising information of portions of code executed by the AUT in response to the application request.
7. The non-transitory machine-readable storage medium of claim 4 , further comprising instructions that if executed cause the device to:
receive information from the first runtime agent responsive to the header, the received information comprising information of an internal operation of the AUT responsive to the application request.
8. A method performed by a system comprising a hardware processor, comprising:
initiating a security test on an application under test (AUT) executing at a server;
determining an application vulnerability associated with the AUT during the security test;
determining a first framework associated with the AUT and used at the server;
selecting a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
exploiting the application vulnerability to provide a script on the server, wherein the script causes the server to download the first runtime agent, unpack the first runtime agent, and install the first runtime agent;
restarting the AUT prior to a continuation of the security test and after the installation of the first runtime agent; and
continuing the security test using the first runtime agent executing at the server to receive additional information about the AUT.
9. The method of claim 8 , wherein the first runtime agent is used to provide the additional information about what is being executed by the AUT.
10. The method of claim 8 , wherein the determined application vulnerability includes command injection.
11. A computing system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
perform a security test on an application under test (AUT) to execute on a server; determine that an application vulnerability associated with the AUT identified by the security test is capable of an injection exploit;
determine a first framework used at the server and associated with the AUT;
select a first runtime agent from a group of runtime agents based on determining that the first framework associated with the AUT is used at the server, wherein different runtime agents of the group of runtime agents are associated with respective different frameworks, wherein the selecting of the first runtime agent is based on accessing a data structure that correlates the different runtime agents with the respective different frameworks;
exploit the application vulnerability to download a script to the server to cause the server to download the first runtime agent, unpack the first runtime agent, and install the first runtime agent;
restart the AUT prior to a continuation of the security test and after the installation of the first runtime agent; and
continue the security test using the first runtime agent executing at the server to receive additional information about the AUT including requested trace information about what is executing at the AUT.
12. The computing system of claim 11 , wherein the instructions are executable on the processor to:
use the additional information to perform an attack vector on the AUT.
13. The computing system of claim 11 , wherein the instructions are executable on the processor to:
add a header to an application request sent to the AUT, the header comprising information useable by the first runtime agent to diagnose the application vulnerability.
14. The computing system of claim 13 , wherein the instructions are executable on the processor to:
receive information from the first runtime agent responsive to the header, the received information comprising information of portions of code executed by the AUT in response to the application request.