The Challenges of Automated Web Application Scanning: "Why automated scanning only solves half the problem."
Jeremiah Grossman, CEO, WhiteHat Security, Inc.
Web application scanning presents many unique challenges. The biggest challenge is that the increasing complexity and diversity of Web applications make it extremely difficult for any scanner to effectively identify security issues. The goal in typical network vulnerability scanning is to identify "known security issues in known code." Unfortunately, the problem is more complex in Web application vulnerability scanning, where the mission is to identify "known security issues in unknown code." With this in mind, we will dive into the specific details that make Web application vulnerability scanning difficult, discussing the lessons learned and recommended solutions. Scanning a Web application for vulnerabilities is akin to remotely black-box testing an unknown piece of code. The remote scanner does not have access to source code, knowledge of what programming language was used, what actions the software performs, and it won't even know on what platform the application resides. The benefit of known security issues is lost within web application vulnerability scanning and the scanner must resort to identifying classes of vulnerabilities, such as cross-site scripting and SQL injection. However, there are security issues that go beyond simple classes and target exploitation of the flow in application business logic. These business logic issues are arguably impossible for any automated process to uncover and yet are some of the most dangerous. The list of challenges faced by today's web application vulnerability scanner is endless.