IBM Application Security Insider

Automated Blackbox Crawling: The Next Generation

Automated crawling of web applications is the first step in automating web application security analysis. Without a proper crawl, automated testing of vulnerabilities will reveal incomplete results (AKA "False Negatives").

Modern web technologies, like AJAX, result in more responsive and usable web applications, sometimes called Rich Internet Applications (RIAs). Traditional crawling techniques are not sufficient for crawling RIAs.

Our security research team has proposed several crawling methods in the past and is constantly enhancing the research. We present a new strategy for crawling RIAs. This new strategy is designed based on the concept of “Model-Based Crawling” (previously introduced by our team) and uses statistics accumulated during the crawl to select what to explore next with a high probability of uncovering some new information. The performance of our strategy is compared with our previous strategy, as well as the classical Breadth-First and Depth-First on two real RIAs and two test RIAs. The results show this new strategy is significantly better than the Breadth-First and the Depth-First strategies (which are widely used to crawl RIAs), and outperforms our previous strategy while being much simpler to implement.

Our research paper:

A Statistical Approach for Efficient Crawling of Rich Internet Applications
A Statistical Approach for Efficient Crawling of Rich Internet Applications (Long version)

(Research by: Mustafa Emre Dincturk, Suryakant Choudhary, Gregor von Bochmann, Guy-Vincent Jourdan, and Iosif Viorel Onut)

This summer (27.7.2012), we are presenting our latest results at ICWE 2012 in Germany, as part of the Web Crawling Track.

A spotlight on JSA, the amazing hybrid security analysis for JavaScript

By now you have probably heard about JSA. Introduced in AppScan Standard 8.0 in Oct '10, and now included in AppScan Enterprise 8.6, JSA is a component that does static analysis of JavaScript to detect a range of client-side security issues. Issues such DOM-based XSS, Open Redirect, and many others.

Why is this significant? 

Client-side code percentage in web applications grew from around 5% five years ago, to an amazing 25% today. Driven by the Web 2.0 explosion, JavaScript is now everywhere, on every web page. And guess what -- it's painfully full of security holes. Evil, nasty ones, that are particularly difficult to catch.

We were really surprised when we discovered that nearly 1 in 6 of the Fortune 500 websites have serious, exploitable security issues in their JavaScript code. You can imagine this got a lot of attention when we shared these news with the world. It quickly become the #1 downloaded whitepaper in IBM Rational.

AppScan’s new Application Discovery Assistant (ADA) saves the Day!!

The next release of AppScan was announced June 5^th and while it will not be ready for customers until June 12^th, I was able to obtain a pre-release copy and started to exercise some of the new capabilities.  I was specifically interested in checking out some of the new tools for on-boarding applications quickly.

Have you ever had to perform a static analysis security assessment of an application, but didn’t know where or what all the parts and pieces are?  Most reviews start when the developer gives you a massive zip file of the “application” or you check-out the source code directly from the source code repository.  As a security guy, with a development background and who has built and reviewed hundreds of applications, it’s always a daunting task to find all the buildable source code and the dependent libraries from distributions like these.