1

I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also.

But running these injections on every text fields is a tedious task and takes most of the time. As per my understanding, if we run these injections on any one text field in each page should give the same vulnerable results instead of running on all text fields on that page for the project.

Please suggest if this approach makes any sense?

Improve this question
  • What if not every field is vulnerable, but some are? – multithr3at3d Feb 2 '18 at 2:14
  • Well first off are all the tests needed - are you running SQL or have any component that a command injection could affect. – McMatty Mar 4 '18 at 23:51
5

It all depends on how your application handles the fields. If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, applications usually use fields differently.

There are various ways to speed up ZAP scans - see this blog post: https://blog.mozilla.org/security/2013/07/10/how-to-speed-up-owasp-zap-scans/

Improve this answer
  • As mentioned abovedepends on the application - calls going through different API then test the web API directly. If you are submitting a form with variables just fire that through multiple times change form / query string values. You should know where the entry points are on your application – McMatty Mar 4 '18 at 23:53
  • Since SE does not allow direct messages pardon for off-topic question. Could you please point me to some resources for learning about development of HTTP proxy and Web App Scanner ? – Rahul Dec 22 '18 at 6:49
  • Thats a big topic! Can you explain in more details what you want to know? – Simon Bennetts Dec 27 '18 at 9:39
1

Yes you need to test every single field, you cannot be certain there are no vulnerabilities in the fields you don't test. In theory you could claim the exact same code is processing all the fields on that page, but in real world scenarios I've found that it's not really the case. So without knowing your environment and other security related tests (SAST, code review, etc) the answer is yes you need to test every field.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.