Determine vulnerability using runtime agent and network sniffer
Example embodiments disclosed herein relate to determination of vulnerability of an application under test using a runtime agent and network sniffer during a security test. A runtime agent monitors execution of an application under test. A network sniffer is used to identify a probe value for determination of the vulnerability.
1. A computing system comprising:
a runtime agent engine to monitor an application under test (AUT) executing at a server during a security test;
a network sniffer engine,
wherein the runtime agent engine receives a notification from the security test of an identifiable probe value,
wherein the runtime agent engine communicates the identifiable probe value to the network sniffer engine,
wherein the network sniffer engine monitors communication traffic from the AUT,
wherein the network sniffer engine identifies the identifiable probe value,
wherein the network sniffer engine provides an indication to the runtime agent engine that the identifiable probe value was identified, and
wherein the runtime agent engine provides the indication to the security test, and wherein the security test is to determine a potential AUT vulnerability based, at least in part, on the indication.
2. The computing system of claim 1 , wherein the network sniffer engine identifies the identifiable probe value in a packet, and wherein the indication includes the packet.
3. The computing system of claim 1 , wherein the computing system further includes the security test, wherein the security test receives a location of a network listener, and the security test is implemented using a scanner.
4. The computing system of claim 3 , wherein the computing system further generates an attack vector to attempt to cause the AUT to communicate with the network listener based on the potential AUT vulnerability.
5. The computing system of claim 4 , wherein the runtime agent receives another indication that the network listener has been communicated with, and provides the other indication to the security test.
6. The computing system of claim 5 , wherein the security test generates a report including the potential AUT vulnerability as a vulnerability.
7. A non-transitory machine-readable storage medium storing instructions for facilitating detection of vulnerability that, if executed by at least one processor of a computing system, cause the computing system to:
monitor, at a runtime agent, execution of an application under test executing at the device during a security test;
receive notification from the security test of an identifiable probe value;
send the identifiable probe value to a network sniffer to monitor at least one external communication of the application under test;
receive indication from the network sniffer that the network sniffer has identified the identifiable probe value; and
provide indication to the security test that the network sniffer has identified the identifiable probe value.
8. The non-transitory machine-readable storage medium of claim 7 , further comprising instructions that, if executed by the at least one processor, cause the computing system to:
receive a packet including the identifiable probe value from the network sniffer,
wherein the at least one external communication includes the packet.
9. The non-transitory machine-readable storage medium of claim 7 , further comprising instructions that, if executed by the at least one processor, cause the computing system to:
provide a location of a network listener to the security test.
10. The non-transitory machine-readable storage medium of claim 9 , wherein the application under test is further attacked by the security test to communicate with the network listener.
11. The non-transitory machine-readable storage medium of claim 10 , further comprising instructions that, if executed by the at least one processor, cause the computing system to:
receive another indication from the network listener that a communication occurred; and
provide the other indication to the security test.
12. A method comprising:
monitoring, via a runtime agent, an application under test (AUT) executing at a server during a security test;
receiving, at the runtime agent, a notification from the security test of an identifiable probe value,
communicating, by the runtime agent, the identifiable probe value to a network sniffer, wherein the network sniffer monitors communication traffic from the AUT,
identifying, at the network sniffer, the identifiable probe value during the security test,
providing, by the network sniffer, data to the runtime agent engine indicating that the identifiable probe value was identified,
wherein the runtime agent provides the data to the security test, and
wherein the security test is to determine a potential AUT vulnerability based, at least in part, on the indication.
13. The method of claim 12 , wherein the identifiable probe value is included in a packet and the data also includes the packet.
14. The method of claim 12 , wherein the security test is implemented via a scanner, the method further comprising:
generating, at the security test, an attack vector based on the data, wherein the attack vector attempts to communicate, via the potential AUT vulnerability, to a network listener; and
implementing the attack vector.
15. The method of claim 14 , further comprising:
receiving, at the network listener, communication via the implemented attack vector;
communicating the reception of the implemented attack vector back to the security test via the runtime agent; and
setting the potential AUT vulnerability as a confirmed vulnerability based on the communicated reception of the implemented attack vector.