Holey-Moley - metrics of setting a baseline for web vulnerability scanners

1. Holey-Moley-metrics of setting a baseline for web vulnerability scanners Michael Glass Huning(David) Dai Advisor: Herbert Hugh Thompson

2. Problems with security scanners • How do they make their claims? Maintain a ranking of the most important vulnerabilities • Do they actually do what they say they do? Create a framework for openly writing benchmarking website pages for the scanners to test with

3. Vulnerability Ranking System • A real-time vulnerability ranking using the standardized Common Weakness Enumeration (CWE) together with the always up-to-date U.S. government repository of vulnerabilities (NVD). • final_score = count_weight * count_score + cvss_weight * cvss_score Note: count_weight+ cvss_weight = 1

6. Applying the formula with count_weight = 0.5 and cvss_weight = 0.5 gives us:

7. The framework • Mimic “vulnerable” websites • Create finite state machines of chosen vulnerabilities • Record every transition the scanner takes when traversing states • At the end of the test, we can analyze coverage and efficiency of the scanner by looking at which states were visited, in how much time, and over how many transitions.

8. FSM example SQL injection

9. Demo • HP Scrawlr • Claims to detect most of the SQL injection Vulnerabilities • Let’s see how it performs…