0

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have found 2400+ vulnerabilities for Facebook since 2011. But for a smaller website like Coinbase, white hats have only found 200+ vulnerabilities in the past 2 years, despite that both sites have very good bounty incentives.

My question is, are there any measurements for the complexity of a web-application? If so, are there any tools? One requirement is that the measurement shall be made from a black-box view, that is, no access to the source code. Also, it would be good if the complexity measurement is positively correlated with number of vulnerabilities inside the system. Or number of vulnerabilities found by white hat hackers in a year.

One idea is to use web spiders. Web penetrating tools such as Burp Suite has a web spider function. However, web spiders have many issues, such as handling user authentication and dynamically generated contents.

Improve this question
4
  • 1
    See some problems here: 1. External complexity -> internal complexity relationship is not always obvious or true (cue Google's search bar). 2. Larger apps -> more vulns and Larger apps -> better management -> better design, QA, pentesting -> fewer vulns are competing processes.
    – Deer Hunter
    Commented Feb 12, 2016 at 23:10
  • What are you trying to do?
    – Neil Smithline
    Commented Feb 13, 2016 at 1:24
  • @DeerHunter Thanks! For 1, I am actually focus more on external complexity. So www.google.com is extremely simple, while www.gmail.com, drive.google.com would be much more complex. For 2, it is true that large apps receive more resources in design, testing and security enhancing. And I think Facebook, Twitter must have done the best. However, even them receives a lot of valid vulnerability reports every year. So complexity must still play a significant role.
    – ZillGate
    Commented Feb 13, 2016 at 4:41
  • @NeilSmithline Build a tool that can roughly estimate the amount of vulnerabilities in a web app. No need to be very accurate, but at least it can tell you that Facebook probably has more vulnerabilities than Coinbase. Thank you!
    – ZillGate
    Commented Feb 13, 2016 at 4:45

1 Answer 1

Reset to default
1

Whenever we submit an offer for a penetration test we are facing the same question: How complex is the application? Complexity leads to additional attack surface, which leads to a lot of tests, which might lead to a lot of findings which require a lot of documentation. This effort has to be reflected within the offering.

To determine the possible complexity we discuss the application from different points of view:

Code

  • How many code files?
  • How many lines of code?
  • How many functions?
  • Centralized input validation?

Representation/Features

  • How many forms?
  • Authentication available?
  • Session handling available?
  • User initiated registration?
  • Password reset?
  • Captcha?
  • Database access?
  • File download?
  • File upload?
  • Mail sending?
  • etc.

It is not unusual that a customer can't answer these questions. Taking a look at the application allows to get a feeling for it. A crawler like Wget or the according Burp module might help to collect the desired data. A simple grep/find lets determine the forms and other aspects responsible for complexity very quickly. But this kind of blackbox analysis always comes with some uncertainty.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .