In recent years, website and web application release cycles
have become increasingly short. Initially, these short release cycles were a
result of companies attempting to remain competitive — offering more
feature-rich applications and responding to consumers demands more quickly.
As a result, end-users have largely been conditioned to
expect a continual flow of updates and new releases — companies have gone so
far as to publish software development roadmaps so their customers can be kept
apprised of what to expect in the immediate and near-term releases.
While short release cycles and frequent updates are often
seen as a positive, there is also a dark side that needs to be considered. One
of the first causalities in the “race to release” is
web application security. In an attempt to
launch websites and ship web applications as efficiently as possible, security
has become an afterthought.
Despite the risks associated with a potential security
breach (something we covered in
this post), web application security often
takes a backseat to revenue, profit and customer satisfaction. Given that a
100% secure web application is an impossibility, that might seem like a
reasonable approach. After all, security is rarely considered an issue until
it’s too late.
One potential solution to this problem is to spend time
looking at your website or web application from the perspective of a hacker —
in essence, figure out how to hack your website before someone else does.
The Hacker’s Mentality: Why And How?
There is a saying (concept) that floats around web
application security circles called “Hack Your Website First”. The idea behind
this saying is one which promotes a more proactive approach to security. As we
mentioned in the opening paragraphs, web application security is often an
afterthought — that is, until an application is hacked. Of course, by then it’s
usually too late. The damage has been done.
“Hack your website first” seeks to develop the mindset in
which developers and security professionals actively seek out potential
vulnerabilities in web applications the same ways that a hacker would. It’s an
approach that makes a lot of sense — if you can learn to think like the enemy,
you stand a much greater chance of defeating them.
Ask yourself: How would your overall security posture
improve if you were to take a day or two away from the development process and
look for ways to hack your website or web application?
Think Like a Hacker
Often, two of the most significant obstacles when it comes
to managing web application security is understanding:
1.
Which are the primary vulnerabilities that hackers are
looking to exploit?
2.
What tools and techniques are they using to not only
find but exploit those vulnerabilities?
Understanding which vulnerabilities are most commonly
exploited is the first step in learning to think like a hacker. The most
commonly exploited vulnerabilities are those of the technical variety. For
example,
cross-site scripting (XSS), SQL Injection and
command injection.
Obviously, logical vulnerabilities should also be an
important consideration. But in reality, they are often less susceptible to
attack simply because they are more time intensive to exploit and require a
greater level of expertise.
If you are someone who finds analogies to be useful, look at
securing technical vulnerabilities as the equivalent of locking all the doors
and windows on the ground floor of your house before going to bed. Logical
vulnerabilities, on the other hand, are more in line with a burglar setting up
a step-ladder, climbing on the roof of your home and looking for an open
skylight. It’s possible but less likely to happen. You can read the
differences between technical and logical web applicationvulnerabilities for more detailed information.
Act Like a Hacker
Hackers are people too. That means that they have all the
traits and tendencies of developers and programmers. If there is an easier or
more proficient way of completing a task, they’ll take advantage of it.
While you may be inclined to think that hackers spend hours
on end searching for vulnerabilities but they’re smarter than that. More often
than not, hackers are using automated tools and scripts to find and exploit
vulnerabilities. Tools like sqlmap, sqlninja, Canvas,
BruteXSS and Core Impact are often used in the
process of identifying and exploiting vulnerabilities. These tools reduce the
amount of time and effort that hackers need to expend and vastly increase their
reach.
If you think that your web application is unlikely to be a
target of hacking, think again. The target itself is rarely relevant. Hackers
are looking for access to your server resources and bandwidth. If you pay for
it, hackers are happy to take it from you.
If you’re going to put forth an honest attempt to hack your
websites or web applications, you’ll need to employ tools and techniques that
are similar to the hackers. Using an automated web scanner is one of the best
(and easiest) ways to scan one or even hundreds of websites and web
applications.
Using the right tools also means that once a vulnerability
is identified, the process of remediation should be largely automated. Flagging
the vulnerability, assigning it to a developer for patching, re-testing and
reporting can all be automated by a capable web application vulnerability
scanner.
Know Thy Enemy (Hackers)
In The Art of War, Sun Tzu stated that “If you know the
enemy and know yourself, you need not fear the result of a hundred battles”.
By learning to hack your website or web application first,
you’ll develop an intimate knowledge of the tools, vulnerabilities and exploits
that are often used by hackers.
