This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "GSoC2013 Ideas/OWASP ZAP CMS SCANNER"

From OWASP
Jump to: navigation, search
Line 42: Line 42:
  
 
                         [[File:CMSSFunctions.jpg]]
 
                         [[File:CMSSFunctions.jpg]]
 +
 +
 +
- Enumerating Vulnerable plugins , themes and Components
 +
 +
 +
- Enumerating from a well-known list
 +
 +
 +
- Enumerating from web search
 +
 +
 +
- Enumerating using the ZAP api
 +
 +
 +
- Enumerating Security measures (firewalls, security plugins  ...)
 +
 +
 +
          [[File:CMSSModules.jpg]]

Revision as of 17:53, 28 June 2013


Introduction

Latest Stats Show that the usage of CMS has grown in the last 5 years Just WordPress and Joomla occupy more than 6% of the top 1 million site The Usage Has Grown in Both Corporate and Personal sites And with the Chaotic Development of plugins and Components in those CMSs The risk of vulnerabilities and flows increase more and more

           StatCMS.jpg

OWASP ZAP CMS SCANNER is a Scanner with More specified search methods


Functionalities

- Enumerating Plugins and Components and Themes in the CMS (Passive and Aggressive Search methods)

- Enumerating from page content

- Enumerating from lists (or database)

- Version Fingerprinting (with multiple methods)

- Labor intensive to add signatures

- Manually locate version in files or build regexes for headers

- Built-in options to remove identifiers (eg, meta generator)

- Very Generic

- Fast

- Low resource usage

- Accurate (Low FP/FN)

- Resistant to hardening/banner removal

- Super easy to support new versions/apps

                       CMSSFunctions.jpg


- Enumerating Vulnerable plugins , themes and Components


- Enumerating from a well-known list


- Enumerating from web search


- Enumerating using the ZAP api


- Enumerating Security measures (firewalls, security plugins ...)


         CMSSModules.jpg