Dieses Dokuwiki verwendet ein von Anymorphic Webdesign erstelltes Thema.

Razlike

Slijede razlike između dviju inačica stranice.

Poveznica na ovu usporedbu

Starije izmjene na obje strane Starija izmjena
Novija izmjena 		Starija izmjena
racfor_wiki:dinamicka_analiza_sigurnosti_aplikacija [2021/01/16 17:51]
smatesic [Dynamic testing strong suites] 		racfor_wiki:dinamicka_analiza_sigurnosti_aplikacija [2023/06/19 18:17] (trenutno)
Redak 3: Redak 3:
 ===== Summary ===== ===== Summary =====
  
-Security testing is crucial to ensuring minization of data breaches which bring financial losses, +Security testing is crucial to ensuring minimization of data breaches which bring financial losses, 
 losses of private data and to some - loss of reputation. Costs of testing are non-negligible, however  losses of private data and to some - loss of reputation. Costs of testing are non-negligible, however 
 the cost of data breaches in total is even greater.  the cost of data breaches in total is even greater. 
Redak 31: Redak 31:
 ===== Dynamic testing drawbacks ===== ===== Dynamic testing drawbacks =====
  
-One of the two most significant drawbacks as opposed to static testing is that dynamic testing can detect not nearly as many vulnerabilities as static testing can. This is because static testing covers the entirety of the code base and as such can detect vulnerabilities even in code that is perhaps run only in some specific circumstances which dynamic testing would possibly miss. The other significant drawback is the fact that dynamic testing requires a functioning system which means that testing can begin at the end of the development life-cycle. Static testing, on the other hand, can be utilised during the entirety of development thus saving resources. +One of the two most significant drawbacks as opposed to static testing is that dynamic testing can detect not nearly as many vulnerabilities as static testing can [9]. This is because static testing covers the entirety of the code base and as such can detect vulnerabilities even in code that is perhaps run only in some specific circumstances which dynamic testing would possibly miss. The other significant drawback is the fact that dynamic testing requires a functioning system which means that testing can begin at the end of the development life-cycle [9]. Static testing, on the other hand, can be utilised during the entirety of development thus saving resources. 
  
 As far as the scope of discoverable vulnerabilities, dynamic testing is limited to vulnerabilities such as Cross-site scripting, code injection, denial-of-service and others in smaller percentages. This is due to the fact that many vulnerabilities are more easily found by analyzing code rather than looking for extremely unlikely parameter combinations which exploit that particular vulnerability. As far as the scope of discoverable vulnerabilities, dynamic testing is limited to vulnerabilities such as Cross-site scripting, code injection, denial-of-service and others in smaller percentages. This is due to the fact that many vulnerabilities are more easily found by analyzing code rather than looking for extremely unlikely parameter combinations which exploit that particular vulnerability.
  
-Another important disadvantage to using dynamic testing is that it offers no information as to which parts of the code are responsible for the detected vulnerabilities. This means that upon completion a tester must analyze the uncovered security flaws and then deduce which part of the system is responsible. It must be said, however, that some vulnerabilities such as SQL injection have well-known causes which give the tester a very good idea of the problem origin.+Another important disadvantage to using dynamic testing is that it offers no information as to which parts of the code are responsible for the detected vulnerabilities. This means that upon completion a tester must analyze the uncovered security flaws and then deduce which part of the system is responsible. It must be said, however, that some vulnerabilities such as SQL injection have well-known causes which give the tester a very good idea of the problem origin [8]. 
 ===== Dynamic testing tools ===== ===== Dynamic testing tools =====
  
-Tools provide much needed automatization when it comes to security testing. Although tools provide help to testers both in dynamic and static testing scenarios, static testing has a much better use for the automatization they offer because of the potential for enormous code bases which can be daunting to analyze manually. That being said, dynamic testing also has uses for tools. Many tools exist, both open-source and commercial, which can help a tester in finding vulnerabilities. OWASP provides a list of vulnerability scanning tools aimed at web applications which they have deemed the best in the business. +Tools provide much needed automatization when it comes to security testing. Although tools provide help to testers both in dynamic and static testing scenarios, static testing has a much better use for the automatization they offer because of the potential for enormous code bases which can be daunting to analyze manually. That being said, dynamic testing also has uses for tools. Many tools exist, both open-source and commercial, which can help a tester in finding vulnerabilities. OWASP provides a list of vulnerability scanning tools aimed at web applications which they have deemed the best in the business [10]. 
  
-The tool chosen to demonstrate what open-source dynamic security testing tools can do is OWASP ZAP. It is an open-source web scanner developed by OWASP with thourough and user-friendly documentation. In its core it is a MITM proxy.+The tool chosen to demonstrate what open-source dynamic security testing tools can do is OWASP ZAP. It is an open-source web scanner developed by OWASP with thourough and user-friendly documentation. In its core it is a MITM proxy [11].
  
 {{:racfor_wiki:mitm_proxy.png?400|}} {{:racfor_wiki:mitm_proxy.png?400|}}
Redak 54: Redak 55:
  
 The target URL will be http://localhost/mutillidae. Mutillidae is a web application which includes vulnerabilities on purpose so that penetration testers can practice. The application is run locally.  The target URL will be http://localhost/mutillidae. Mutillidae is a web application which includes vulnerabilities on purpose so that penetration testers can practice. The application is run locally. 
-To start testing, simply click the Attack button. Testing takes quite a long time because of the extensive list of features the application has.  
- 
 {{:racfor_wiki:scan_results.png?400|}} {{:racfor_wiki:scan_results.png?400|}}
  
 +Scan results are shown in the image above. As the image shows, ZAP can provide information on the most common and dangerous vulnerabilities.
 +===== Conclusion =====
  
 +Even though certain drawbacks keep it from being the ultimate security testing method in all cases, dynamic testing still presents a valuable method of testing in most cases, and even the best in some scenarios. To utilize its potential to the fullest, a combination of manual testing and automated tool-based testing is recommended.
 +Many very good tools exist, some of which are open source, so that even the penetration-testing enthusiasts can test their applications to improve upon their development. Other, commercial tools, serve to improve professional testing quality and reduce costs which can help mitigate a lot of threats to data security which are present because testing bears a greater price than many would accept.
 +To make sure a system is secure in a broader set of scenarios, a hybrid method should be used - a combination of dynamic and static testing.
 +This would allow for a tester to assess the full security profile of a system. 
 + 
  
- +===== Sources =====
- +
- +
-===== Zaključak ===== +
- +
-Even though certain drawbacks keep it from being the ultimate security testing method in all cases, dynamic testing still presents a valuable method of testing in most cases, and even the best in some scenarios. To utilize its potential to the fullest, a combination of manual testing and automated tool-based testing is recommended. Many very good tools exist, some of which are open source, so that even the penetration-testing enthusiasts can test their applications to improve upon their development. Other, commercial tools, serve to improve professional testing quality and reduce costs which can help mitigate a lot of threats to data security which are present because testing bears a greater price than many would accept.  +
- +
-===== Literatura =====+
  
 [1] IBM, Cost of a Data Breach Study Report highlights, https://www.ibm.com/security/data-breach, accessed on 14.1.2021 [1] IBM, Cost of a Data Breach Study Report highlights, https://www.ibm.com/security/data-breach, accessed on 14.1.2021
Redak 86: Redak 85:
  
 [9] HDivSecurity, 20.7.2020, What is DAST? All About Dynamic Application Security Testing tools, https://hdivsecurity.com/bornsecure/dast-dynamic-application-security-testing/, accessed on 14.1.2021 [9] HDivSecurity, 20.7.2020, What is DAST? All About Dynamic Application Security Testing tools, https://hdivsecurity.com/bornsecure/dast-dynamic-application-security-testing/, accessed on 14.1.2021
 +
 +[10] OWASP, Vulnerability Scanning Tools, https://owasp.org/www-community/Vulnerability_Scanning_Tools, accessed on 14.1.2021.
 +
 +[11] OWASP ZAP, Documentation, https://www.zaproxy.org/docs/, accessed on 14.1.2021
racfor_wiki/dinamicka_analiza_sigurnosti_aplikacija.1610815863.txt.gz · Zadnja izmjena: 2023/06/19 18:14 (vanjsko uređivanje)
Dieses Dokuwiki verwendet ein von Anymorphic Webdesign erstelltes Thema.
CC Attribution-Share Alike 4.0 International
www.chimeric.de Valid CSS Driven by DokuWiki do yourself a favour and use a real browser - get firefox!! Recent changes RSS feed Valid XHTML 1.0