<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Yahoo released a <a href="https://github.com/yahoo/gryffin">horizontally
scalable web scanner today</a>, written in GoLang. It's worth a
look. <br>
<br>
I think there are strategic cyber security lessons to be learned
from Yahoo releasing a free horizontally scalable web scanner and
that's what this mailing list is about so let's delve.<br>
<br>
Let's look at history. Back in the day you would hire someone to do
a web assessment, and they would get WebInspect or AppScan and scan
your site, and then they'd poke around on it a little bit with an
in-line proxy, and write you a report. Scanning a site with
WebInspect took time - maybe each consultant on a team would be
doing three scans at once. But the reports invariably would say
things like "Hey, we noticed you did all your authentication on the
client side. That's cool, but maybe let's try it on the server next
time?"<br>
<br>
This is where mobile apps are now. They fail to realize that people
can mess with variables and so they are making all the mistakes
people made on web apps in 2002. Tooling for security for them is
terrible too, which is something we have a video coming out on soon.
(Foreshadowing! I does it!)<br>
<br>
WebInspect and AppScan got absorbed by giant development chain
companies (IBM and HP) and are now "inline" with your whole
development process and this is of course because white box testing
is a hell of a lot easier than black box testing. But application
penetration testing split invisibly and we forgot to tell anyone.
One aspect of it is the deep look by a real hacker - typically a
white-box approach. And in those cases, you get cryptographic bugs,
insane timing bugs, logic bugs, XSRF bugs, and external entity bugs.
SQL Injection and XSS are a side-note. And of course on the other
hand there is Lulzsec-style: We scanned your box and five thousand
other boxes with Hajiv and found an SQLi and a file traversal and
actually hacked you. <br>
<br>
Hajiv and sqlmap (and WebInspect and AppScan) don't scale but to
solve that problem are the giant scanning farms and until yesterday
they were all close-hold:<br>
<ol>
<li>WhiteHat</li>
<li>Veracode</li>
<li>Qualys</li>
<li>Tenable</li>
<li>WebSiege (Immunity)</li>
<li>Gryffon (Yahoo)</li>
<li>PunkSpider</li>
<li>Google's XSS Scanner (only available for scanning your
AppEngine apps)<br>
</li>
</ol>
<p>Are there others? And by others I mean ones that can handle "I
have 100000 web applications to scan." <br>
</p>
The concept I think we keyed in on a long time ago is that the
surface had changed. Much as anybody can run a full on Internet-scan
for a port, they can also map your whole web application and the
important thing is, they already have. At some level the "Lulzsec"
problem was because companies didn't want to face the reality that
their defensive surface had expanded like a 24/7 cable news channel
all about little Bobby Tables. And the answer, of course, is
partially continuous monitoring, and partially out-sourced
vulnerability validation (bug bounties). <br>
<br>
-dave<br>
<br>
<br>
<br>
<br>
</body>
</html>