This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "GSoC2013 Ideas/OWASP ZAP CMS SCANNER"
Line 101: | Line 101: | ||
ZAP CMS scanner extension consists of three main modules: | ZAP CMS scanner extension consists of three main modules: | ||
− | '''1- CMS detection module ''' | + | ''''''1- CMS detection module '''''' |
mains to indicate what cms uses the application of given url, two methods are used with CMS detector : | mains to indicate what cms uses the application of given url, two methods are used with CMS detector : | ||
− | '''A- Passive search''' | + | '''A- Passive search''' |
Line 120: | Line 120: | ||
− | '''b- Agressive search''' | + | '''b- Agressive search''' |
Line 127: | Line 127: | ||
− | + | ''''''2- plugins enumerating module '''''' | |
Line 133: | Line 133: | ||
The purpose of this module is to list the plugins used in the application of the given url, both passive and active methods are always possible | The purpose of this module is to list the plugins used in the application of the given url, both passive and active methods are always possible | ||
− | 1 - passive search: analyzing the page content using regex | + | 1 - passive search: analyzing the page content using regex |
− | 2 - aggressive research: using a list of names of plugins, which will be compared with any names found in specific URLs, for example, WordPress plugins in : url + / wp-content/plugins / | + | 2 - aggressive research: using a list of names of plugins, which will be compared with any names found in specific URLs, for example, WordPress plugins in : url + / wp-content/plugins / |
Revision as of 17:33, 4 July 2013
Introduction
Latest Stats Show that the usage of CMS has grown in the last 5 years Just WordPress and Joomla occupy more than 6% of the top 1 million site The Usage Has Grown in Both Corporate and Personal sites And with the Chaotic Development of plugins and Components in those CMSs The risk of vulnerabilities and flows increase more and more
OWASP ZAP CMS SCANNER (ZAP CMSS) is a Scanner with More specified search methods
Functionalities
- Enumerating Plugins and Components and Themes in the CMS (Passive and Aggressive Search methods)
- Enumerating from page content
- Enumerating from lists (or database)
- Version Fingerprinting (with multiple methods)
- Labor intensive to add signatures
- Manually locate version in files or build regexes for headers
- Built-in options to remove identifiers (eg, meta generator)
- Very Generic
- Enumerating Vulnerable plugins , themes and Components
- Enumerating from a well-known list
- Enumerating from web search
- Enumerating using the ZAP api
- Enumerating Security measures (firewalls, security plugins ...)
Matches
Matches are made with:
- Text strings (case sensitive)
- Regular expressions
- Google Hack Database queries (limited set of keywords)
- MD5 hashes
- URL recognition
- HTML tag patterns
- Custom java code for passive and aggressive operations
features
- Control the trade off between speed/stealth and reliability
- Plugins include example URLs
- Performance tuning. Control how many websites to scan concurrently
- Result certainty awareness
- Fast
- Low resource usage
- Accurate (Low FP/FN)
- Resistant to hardening/banner removal
- Super easy to support new versions/apps
ZAP CMSS modules
ZAP CMS scanner extension consists of three main modules:
'1- CMS detection module '
mains to indicate what cms uses the application of given url, two methods are used with CMS detector :
A- Passive search
based on page content analysis :
1 - using text string (case sensitive) 2 - using regex
these two methods are used to recognize html tags, eg: meta tag Generator, or to extract texts from the page showing the tool with which this application is created
3 - using google hacks (from a list of predefined keywords)
b- Agressive search
Is to try known and unique URLs from a predefined list, the presence of these paths indicates with certainty the CMS used, the problem with this method is that it will not be very effective in if several CMSs are supported, this because of the absence of a single file in this case
'2- plugins enumerating module '
The purpose of this module is to list the plugins used in the application of the given url, both passive and active methods are always possible
1 - passive search: analyzing the page content using regex
2 - aggressive research: using a list of names of plugins, which will be compared with any names found in specific URLs, for example, WordPress plugins in : url + / wp-content/plugins /