What is DAST/Active Scanning?

Published on: 2019-10-15

Image by OpenClipart-Vectors from Pixabay

If you're new to security scans, you may be unsure about what a Dynamic Application Security Test tool (also known as "active" or "black-box" scanning) does or how it works. If this is you, read on!

How DAST scanners work

DAST scanners, regardless of whether they're based in the cloud or are installed in your environment, generally follow the same process:

Try to log into your website using credentials you provided (if you provided any)
Crawl your website, following links, submitting forms, etc., in an attempt to find all pages
Analyze results for obvious vulnerabilities like missing headers or missing CSRF tokens (aka passive scanning)
Submit semi-malicious input in an attempt to exploit vulnerabilities, such as submitting <script>alert(1)</script> to look for XSS (Cross-Site Scripting) attacks or ' OR 1=1 -- for SQL Injection attacks
Analyze the results and return them to you in some format

What you should expect scanners to find

Most scanners publish the list of modules that they include in their scans (and many allow you to include or exclude modules in their configuration) so you can see what they say they look for. Unfortunately, my experience is that just because a scanner says that it looks for something doesn't mean it's effective at doing so. Some scanners check for the most straightforward cases of a particular vulnerability if it bothers looking for it at all. Most DAST scanners are good at finding some things, though. Here's a list of some vulnerabilities that are likely to be found by most DAST scanners I've used:

Straightforward XSS or SQL Injection attacks
Missing security-related headers
Simple and obvious backdoors (such as using admin/password as credentials for your administrator account)
Operating system and file path vulnerabilities
Unprotected redirection to other sites
Exposed backup files or passwords
Missing or misconfigured SSL certificates

Most scanners will also report items that should be looked at as "findings" despite the fact that no verifiable security issue exist. Common ones include:

Presence of file upload functionality
Presence of potential privacy issues, such as exposed email addresses
Importing third-party script or CSS files

Better scanners will find a wider range of issues and are better at finding issues while reducing false positives, but still generally follow this pattern.

What you should expect the scanners to miss

Scanners that are built to scan a wide variety of websites in several different languages are not going to be able to find problems with your application-specific logic. If your file upload functionality has a particular issue related to the processing of its contents, it's unlikely that your scanner will find the issue. The same thing can be said for protecting assets that are accessible to a subset of users or rare functionality, such as an image generator.

Finally, it's worth pointing out that since these scanners don't have access to your source code, it is impossible for them to find security issues that cannot be found from the website alone. Just a few of these vulnerabilities include:

Cryptography issues such as poorly-implemented algorithms, use of insecure algorithms, or insecure storage of cryptographic keys
Inadequate logging and monitoring
Use of code components with known vulnerabilities

To find these issues, you need a Static Application Security Test (SAST) scan, a Software Component Analysis (SCA) scan, and a manual penetration test.

Differences between scanners

While most scanners tend to look for the same types of things, there are several differences between scanners that are worth noting:

Support for JavaScript frameworks can vary widely from scanner to scanner. If you have a SPA (Single-Page Application) website, you may have difficulties getting a decent scan from some scanners.
Authentication support can vary from scanner to scanner. Some scanners only support username and password for authentication, some scanners are highly configurable, and some scanners say that they're highly configurable but most methods don't work. Look for scanners that allow you to script logins.
Some scanners explicitly try to minimize false positives with the goal of making sure you're not wasting your time on mistakes by the scanner. But in my experience, scanners that minimize false positives have an unacceptably high number of false negatives. Most scanners have some flexibility here — allowing you to do a fast scan when needed, but also allowing a detailed scan when you have time.
Generally, free scanners can find vulnerabilities but are not great at reporting and managing findings. If you’re looking for a way to manage your findings, you need to either purchase an expensive scanner or build something yourself.

Is there any risk in running these scanners against a website?