By Dan Cornell
Recently I’ve been working with some other Denim Group folks to do our regular internal benchmarking of various application security scanners. Last week we got into a deep discussion of false positives, how many scanners claim to reduce or eliminate them, and different techniques to make this happen. During the talk we came across an idea for a surefire way to completely eliminate false positives and this weekend I had enough free time to put together a proof of concept. I’ve included the proof of concept code at the bottom of this post and you can consider it to be released under the Apache 2.0 license.
This is revolutionary enough that we are currently trying to make testing with this technology required for Scanless PCI Certification and we want to make sure that all Certified Application Security Specialists are required to be conversant with it. We’re considering shifting all our use of scaning tools to use our new technology.
Below is the proof of concept code:
package com.denimgroup.nofalsepositives;
import java.util.ArrayList;
import java.net.MalformedURLException;
import java.net.URL;
public class DynamicAnalyzer
{
public static void main(String[] args)
{
ArrayList vulnerabilities = new ArrayList();
String sUrlToScan;
URL urlToScan = null;
long scanStart;
long scanEnd;
// Must at least enter a URL for the site to scan
if(args.length < 1) {
usage();
System.exit(1);
}
// Make sure the URL is valid
sUrlToScan = args[0];
try {
urlToScan = new URL(sUrlToScan);
} catch (MalformedURLException e) {
System.out.println("Provided URL was invalid. Unable to scan.");
System.exit(2);
}
// Kick off the scan
scanStart = System.currentTimeMillis();
System.out.println(String.format("Starting scan of %s at %d", urlToScan.toString(), scanStart));
// Finalize scan and report findings
scanEnd = System.currentTimeMillis();
System.out.println(String.format("Finished scan of %s at %d", urlToScan.toString(), scanEnd));
System.out.println(String.format("Found %d vulnerabilities with NO false positives", vulnerabilities.size()));
}
public static void usage()
{
System.out.println("usage: java com.denimgroup.nofalsepositives.DynamicAnalyzer <SITE_URL>");
}
}
In case anyone hasn’t figured it out by now this whole post is completely facetious. Automated scanning has its place in any credible application security program, but no credible application security program consists only of automated scanning. And you will always get false positives as well as results that need to be re-prioritized based on the business context of the vulnerability. Automation is great, but you can’t automate everything.
Contact us if you would like more info on constructing your application security program.
dan _at_ denimgroup.com
@danielcornell
Posted via email from Denim Group's Posterous
