Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
1

Is there a Dynamic application security testing (DAST) tool which can run over dynamic html /JavaScript ajax applications? An open source option would be ideal - or if that does not exist, then a feature of an Enterprise tool would be the silver medal answer.

I have an ExtJS(JavaScript) application and tried using HP Fortify, but this tool sees only the index page and cannot run analysis of the application as a result.

I am not looking for a tool to provide protection by itself, but as one item in my tool belt to aid in providing some notification that obvious or glaring errors are present in the application (Other tools being code-reviews, penetration testing, etc) Any result set from the tool should inform the presence of problems, but I understand that no tool would be able to inform of their absence.

Also, any tool would be used in addition to concurrent penetration testing. Examples where you personally have experience with the tool will be given an answer, as after demo of IBM AppScan and discussion of NTO Spider, I still have nothing concrete (not marketing material) which indicates if this problem is just a rabbit hole.

share|improve this question
1  
Theres a product called NTO Spider which claims to do this. Get in touch with them and see what they say. – D3C4FF Feb 28 at 22:37

2 Answers

up vote 2 down vote

You are looking for the "silver bullet" for vulnerability scanning. Every vulnerability scanner claims to support JavaScript and Web Service based applications and its a complete and total lie. The truth is that this is a very difficult problem to solve, and a sales team will tell you anything to get you to open your wallet.

I test these applications using a blended manual and automated approach. The tool I use is Burp Intruder. I manually use the application with a browser, Burp tracks the requests and then I send them to intruder for fuzzing. If you are not comfortable building your own fuzz test cases and writing exploit code, then you should probably hire a professional penetration tester.

Just running a tool is not going to keep from getting hacked.

share|improve this answer
+1 for mentions of Burp Intruder and fuzz test cases, but I am not looking for silver bullet, just want assistance in spotting errors during release cycle so that this pen testing time isn't wasted finding things which an automation tool could find. – Thronk Mar 1 at 20:04
up vote 0 down vote

IBM has a tool for analyzing Javascript and AJAX-y web applications for vulnerabilities. It's called Javascript Security Analyzer, and I think it is included in some versions of IBM AppScan. I have no personal experience with it, but some of their publications make it sound like it might be what you are looking for. It dynamically crawls your web site to find and exercise all Javascript code, then statically analyzes the Javascript and web pages for client-side XSS and other similar vulnerabilities.

I don't know of any open-source tool of this sort. Web pentesting tools typically don't have the ability to analyze the Javascript code for vulnerabilities, and finding client-side XSS can be non-trivial.

share|improve this answer
AppScan Standard edition claims to have some JavaScript security analysis, but the demo app available in the trial is a c#/asp.net app. As only this app can be scanned, I would need to take their word for it and buy a license to find out if it will actually work. After IT dept bought Fortify and were disappointed, not likely to buy anything else without 100% knowing it will provide value. You are spot on it's non-trivial – Thronk Mar 21 at 14:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.