OUR APPROACH TO VULNERABILITY SCANNING
AppCheck was designed from the ground up to emulate the process of a professional penetration tester to ensure maximum coverage and accuracy
AppCheck takes a first principles approach to application vulnerability detection, and therefore is not bound to any platform or signature database.
Rather than use a database of static signatures, AppCheck approaches each test in the same way a hacker or penetration tester would and applies a testing methodology. The vast majority of application security flaws, such as SQL Injection and Cross-Site Scripting arise from insecure processing of input supplied by the client. AppCheck adopts a first principals approach when testing each input by examining the original expected value and the servers response when the value is modified. By adopting this methodology, AppCheck is able to determine how data may be being processed by the server and can then dynamically evolve each test to identify vulnerabilities. This approach results in more accurate testing and allows AppCheck to identify security flaws that may be masked by security filters and Intrusion Prevention Systems (IPS), but could still be exploited by a real-world attacker.
Crawling and content discovery crawling
The AppCheck crawling engine uses a combination of application modelling techniques and subtle heuristical cues to automatically discover the complete attack surface of any given application in the shortest time possible. The algorithms are designed to model how a penetration tester or attacker would explore the application, utilising visual cues and ruling out equivalent instances of the attack surface if they have already been explored.
All of this means that for each target discovered we know its state at discovery and how to re-create that state to later attack it; and because the scanner is behaving in a more human way, it opens up attack vectors that are inaccessible to less sophisticated crawlers.
How our intelligent crawling works
Identify identical components
An ecommerce application may have several thousand product pages, with each one implementing the same code path within the application. AppCheck identifies these cases and avoids wasting time on identical components.
Identify & replicate behaviour
The application may have components that need to be accessed in a specific sequence, for example, navigating from a product page through a shopping basket flow. AppCheck is able to identify this behaviour and ensure the complete process is followed for each vulnerability check.
Choose a layer to explore
OSINT / Intelligence Gathering
Using multiple Open-Source Intelligence (OSINT) to gather information that can be seeded into the assessment process.
During the discovery phase, the scanner consults multiple open-source intelligence databases to learn as much about the target system as possible. For example, host names registered to the target IP address, web components indexed by search engines, and historical network data. Data that is in scope for the scan is then seeded into the scan configuration.
The core of our Open Source Intelligence (OSINT) service starts with an asset enumeration solution. It involves the utilization of various advanced techniques, including subdomain and top-level domain bruteforcing, DNS zone transfers, reverse DNS sweeping based on specified IP address ranges, search engine scraping, and the consolidation of assets from a wide array of public and private online sources, including VirusTotal, Shodan, HackerTarget and Commoncrawl.
The primary goal of this service is to thoroughly identify and enumerate all related assets associated with a top-level domain or IP address. These assets may include subdomains, IP addresses, and even additional associated top-level domains. Using these enumeration methods we create a detailed map of our client’s external attack surface and provide an idea of the list of possible assets an external malicious threat actor is likely to attempt to target.
This intelligence provides clients with an understanding of their online digital footprint, enabling them to assess potential security risks, conduct further vulnerability scanning, and take proactive steps to enhance their organization’s cybersecurity. In essence, it empowers them with an in-depth view of your online assets.
Gateway Layer
Scanning systems such as firewalls, remote access, and management solutions to identify security flaws.
AppCheck uses multiple dedicated infrastructure scanners to identify vulnerabilities on each accessible network device. The scan begins by port scanning each IP address within the scope to identify accessible services. Each identified service is then probed for vulnerabilities using tens of thousands of checks.
Network Delivery & Presentation Layer
Identifying vulnerabilities within hosting infrastructure used to manage and optimise network traffic to web application servers.
AppCheck combines infrastructure scanning with web application build review check to analyse the flow of data from the scanning node to the target system. Identified systems are checked for known vulnerabilities using a regularly updated vulnerability database that combines well know sources such as the National Vulnerability Database (NVD) with our own internally maintained vulnerability feed.
Application Framework, CMS, and Hosting Layer
Identifying vulnerabilities within Application Frameworks such as ASP .NET, PHP, NodeJS, Java, Apache Tomcat/Struts, Spring, WebLogic, Django, Ruby on Rails and many more.
The AppCheck Web Application scanning engine includes dedicated scanners for a wide range of popular CMS systems and Application Servers and Frameworks. Each scanner is integrated with the Dynamic Security Testing engine so that it can be deployed in the correct way as applicable systems are identified during web crawling and discovery.
Checks for known vulnerabilities, such as those with a CVE identifier, are deployed in the same way and are regularly updated based via AppCheck’s own vulnerability database and several community driven vulnerability feeds (updated daily).
By integrating platform checks within the web application scanning engine, components enumerated during this phase can be passed forward into other scanning layers for further scanning. For example, CMS plugins enumerated during forced browsing checks can then be passed to the DAST scanning engine to discover previously undisclosed vulnerabilities (0day).
Application Code / Input Processing (DAST)
Detecting security flaws within application code through Dynamic Application Security Testing (DAST).
For each URL configured with the scan, AppCheck performs online reconnaissance to gather information pertaining to the site that is publicly available in search engines and other online indexing services. Next AppCheck will map out the application using a sophisticated crawling engine. The crawler combines traditional web scraping with a browser-based crawler which implements artificial intelligence to mimic typical application user behaviour.
The “Mapped Attack Surface” enumerated during the initial phases of the scan is then subject to methodical security testing. Typically, the assessment process works by taking each user supplied data component, such as a form field of query string parameter, then modifies it to include a specific test case before submitting it to the server.
Cloud and Third-Party Trust Layer
Identify third-party components and trust relationships and identify vulnerabilities that arise through the use of vulnerable
components and Cloud Service configuration vulnerabilities.
AppCheck audits all third-party trust relationships for subdomain takeover and related flaws.
AppCheck Identifies known vulnerabilities within deployed JavaScript libraries.
AppCheck assesses Amazon Simple Storage Service (S3) buckets for misconfigurations. This includes insecure permissions and bucket takeover vulnerabilities.
Some vulnerabilities such as Server-Side Request Forgery (SSRF) can have a greater impact when hosted within a cloud environment.
AppCheck includes several cloud specific checks to detect and safely exploit vulnerabilities in cloud systems.
AppCheck identifies JavaScript malware, Card Skimmers and Crypto Mining software. It will also provide a domain report of third-party software including domain age, geolocation and susceptibility to domain takeover.
Open source intelligence gathering
Whilst the AppCheck crawling engine does an excellent job of enumerating the visible attack surface, it can sometimes be the hidden components that are the Achilles’ heel.
Temporary components such as micro-sites and marketing landing pages can become forgotten and unmaintained. These no-longer linked components may hide a critical security flaw and therefore it is important we test every component an attacker may target. AppCheck queries search engines such as Google and other online indexing services to gather a list of URLS both past and present to factor into the attack discovery phase.
Our approach to testing
Web Application scans can be started in just a few seconds by entering a list of URLs into the AppCheck user interface and either selecting one of our extensive pre-configured profiles or by building your own scan configuration. Once started, AppCheck combines open source intelligence gathering and a sophisticated browser based crawling engine to identify application components that could be vulnerable to attack.
Application scanning
For each URL configured with the scan, AppCheck performs online reconnaissance to gather information pertaining to the site that is publicly available in search engines and other online indexing services.
Next AppCheck will map out the application using a sophisticated crawling engine. The crawler combines traditional web scraping with a browser-based crawler which implements artificial intelligence to mimic typical application user behaviour.
The “Mapped Attack Surface” enumerated during the initial phases of the scan, is then subject to methodical security testing. Typically, the assessment process works by taking each user supplied data component, such as a form field of query string parameter, then modifies it to include a specific test case before submitting it to the server. Based on the applications response, further test cases are then submitted through the same method to confirm the vulnerability.
Common vulnerabilities detected during the web application scan include; Injection flaws such as SQL, NoSQL, XML, Code, and Command injection, Cross-Site Scripting and hundreds of other vulnerability classes arising from insecure code.
Infrastructure Scanning
In this context, “Infrastructure” includes all components that are not covered within the application scanning phase. The infrastructure scan begins by port scanning each host to identified accessible services. Each service is then probed for vulnerabilities such as missing security patches, configuration weaknesses and information disclosure vulnerabilities.
Common vulnerabilities detected during the infrastructure scanning phase include; missing operating system patches, weak administrative passwords and access control vulnerabilities.
If the target system is hosted within Amazon Web Services, Google Cloud or Azure, specific configuration assessment modules are launched to identify common configuration weaknesses.
Reporting
At completion, AppCheck provides a detailed report listing the potential impact, a technical narrative detailing how the flaw was detected and detailed remediation advice. Where possible, proof of concept examples are provided so that the flaw can be easily recreated and demonstrated to the relevant stakeholders.
Users can either manage all vulnerabilities through the vulnerability management dashboard, or at the click of a button download custom filtered results and view via HTML, Docx or CSV. AppCheck includes a simple JSON data API for retrieving, aggregating, processing and reporting raw vulnerability data for use in third party applications.
Additionally, multiple (unlimited) user accounts can be created to allow team collaboration. AppCheck includes workflow management allowing you to assign and prioritise each vulnerability’s remediation to nominated members of your team.
Put us to the test.
Try AppCheck for free
Contact us or call us 0113 887 8380
