1

I'm trying to intentionally open up an SQL vulnerability in a web app to see if OpenVAS will pick it up.

There's a url that OpenVAS tries, which is /news/?group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users

I've got a simple NewsPost model and I've created a route that will respond to the above url inside my web app.

The SQL that gets executed is: SELECT * FROM news_posts WHERE group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users.

But for some reason, the OpenVAS scan does not detect this as being vulnerable in my Rails web app.

So I'm wondering, how does OpenVAS determine if it's vulnerable? is it based on the content that the web page returns? the status code returned by the server? or something else?

1
  • Definitely openVAS or any scanner will detect by return from server, "return" is including data response, status code if error 40x, and also time taken to return. If the SQL query above does not return error code or data, openVAS will not let you confirm that this is a SQLinjection.
    – Jay seen
    Nov 22, 2019 at 6:17

1 Answer 1

3

OpenVAS (now part of GVM) is a Vulnerability Scanner. Scanners of this class are checking applications / systems for "known" vulnerabilities like SQL injections within a CMS / Blog software or similar where e.g. a vendor advisory or a security researcher report exists. The check is then done in one of the following ways:

  1. based on an exposed version
  2. by an active check (e.g. SQL injection) to known vulnerable URL / endpoint. In this case quite often application specific response checks (e.g. checking for a specific text) is done.

Checking for unknown vulnerabilities like the SQL injection mentioned by the OP requires a Web-Application Scanner like Acunetix or Burp which often requires user-interaction a Vulnerability Scanner doesn't offer.

Nevertheless from being a Vulnerability Scanner OpenVAS / GVM has some very basic Web-Application Scanner capabilities which needs to be separately enabled within the default scan configuration. For this clone the "Full and Fast" scan config, search for the following VT:

Name: Global variable settings
Family: Settings
OID: 1.3.6.1.4.1.25623.1.0.12288

and configure the "Enable generic web application scanning" to "yes". While i doubt that the SQL injection of the OP will be found it worth a try.

To sum-up:

  1. Vulnerability scanners are checking mainly for "known" (e.g. publicly documented) vulnerabilities via a version check or an active check to the known affected URL.
  2. Unknown vulnerabilities requires a Web-Application Scanner.

To specially answer the question on how OpenVAS/GVM is checking for this specific vulnerability:

The VT doing this SQL injection request is 2009/GForge_multiple_sql_injection.nasl (can be found in your local installation) and once the application is answering with a response containing the following text a vulnerability is reported:

forum_id=$1$

Disclaimer: VT Dev @ Greenbone

You must log in to answer this question.