Legitimately using tools like Havij

Question

I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as well as other vulnerabilities, but I know enough to know that I don't know enough. I'd like to add some additional testing to our process to scan for vulnerabilities throughout the development process.

We already do threat modeling throughout the project, as well as code reviews on all code changes going into production.

Also, as a part of our release process, we have penetration tests ran against our sites in our staging environment before releasing to live, and also in live once it's released. However, I'm not confident that our penetration testing tools are adequate. Also, the penetration tests are costly, and can only be done every so often. I'd really like for our team to perform them throughout the entire development process. (It's a lot cheaper to fix holes early on than later on in the project.)

I'm aware of tools like Havij that are used by cybercriminals, and I'm aware of how easy they make attacking sites with vulnerabilities for even non-technical people. I'd love to be able to use the same tools to test our own web sited in our test, then staging, then production environment. (Why should the bad guys have all the good tools?) But I'm not willing to go to the "shady" sites or newsgroups do download the tools. I wouldn't even know where to look. Even if I did know where to look, our network Admins would never allow us to get those tools from an untrusted source.

Is there a legitimate, trusted place where such tools can be downloaded or purchased for such white-hat purposes? I'm perfectly willing to try to get upper management to pay for membership in white hat groups that might provide these tools, and even better, training, so I'm not necessarily looking for free. I'm just looking for legal and legitimate sources.

Answer 1

I'd like to point you to open source tools that we use in pen-testing web applications:

• Arachni, already mentioned in a previous answer.
• w3af, one of the most famous free open source scanners. This one is written in python and have a consistent UI (GUI and CLI). The project is sponsored by Rapid7, owners of Metasploit and NeXpose
• Skipfish, a fire and forget command line scanner which excels at crawling and forced browsing, produces fancy HTML reports
• OWASP Zed Attack Proxy, the defacto open source web attack proxy. ZAP has an API and integrates code and features of other reference tools like JBroFuzz and DirBuster. It is more suited for semi-automated testing

The following open source tools can help exploiting SQL injection (SQLi) and Cross Site Scripting (XSS) vulnerabilities:

• SQLmap: this CLI python tool is ideal to exploit SQL injection flaws, i.e. dump the database, execute SQL commands and even compromise the back-end database's Operating System. It is similar in purpose to Havij and often used in the wild by script kiddies to exploit vulnerable targets
• BeEF: the perfect tool to demonstrate the risk of XSS flaws, its new shiny Ruby on Rails web interface allows you to leverage XSS vulnerabilities in order to command victim browsers

There are a lot of commercial tools in the web vulnerability scanning market with prices ranging from a couple hundreds dollars to tens of thousands of dollars. These can get you better results than open source ones and can combine features of open source scanning and exploitation tools. However, you'll always need that chair and blood penetration tester to try and break the logic of the application, something a tool, no matter how much it's worth, can never do.

Answer 2

Good answer from Chris Frazier, although I wouldn't personally recommend the CEH. Perhaps I took the test way too long ago, but didn't feel it covers anything close to what a penetration tester or a security-aware developer actually needs.

Perhaps I'm going to give you a slightly unorthodox answer, but it sounds to me like you're already doing quite an amazing job, and the fact that you're still worried alone just shows how much security-awareness there is in your organization. That already puts you in far better position than many other applications I've come across, where security is usually an oversight.

That being said, you shouldn't just relax and think everything is safe (which I doubt you would anyway). There are always things you can do to improve your security. Chris Mentioned some of those. I would also recommend looking at tools that can help with static or dynamic code analysis. There are several commercial vendors in this space with fairly good reputation. Sadly, the open-source alternatives usually lag behind in this particular area.

If you are really serious about plugging in some automated tools, I would suggest having a look at Arachni. There are many web application scanners, but this is probably one of the few that is pretty much built from the ground-up with an API. This probably makes it a prime candidate to integrate with your development / release / continuous-integration process. It doesn't mean it's necessarily better or the only tool you should count on, but at least it should be easy (or easier) to integrate with.

Otherwise, always try to expand your knowledge, read more, check out the questions and tools mentioned here, and try to make sure your entire team is aware of those security issues. I would also recommend spending time with your penetration testers when they do come in to do a scan. There are always some new tricks you can pick up this way.

Answer 3

No. You should not use tools like Zeus or Havij, or other black-hat tools, to assess the security of your site. Zeus isn't designed for vulnerability assessment; they're designed for placing a backdoor once you're in. In general, my experience is that the black-hats don't have better vulnerability assessment tools than white-hat penetration testing and vulnerability assessment services. Moreover, it is dangerous to use software written by the blackhat community; you may find yourself with a self-inflicted Trojan.

Instead, if you'd like to look at how your organization can do more, I'd start researching how you can integrate security into the software development lifecycle. Microsoft has some great resources on this.

Answer 4

I think your a little confused over some of the tools, for example Zeus is a trojan and not used for general website pen testing.

But regardless, there is no magic toolkit you can use for web site assessment. Because of the dynamic nature of web development it really does take a human presence to analyze and find most vulnerabilities. Relying solely on a set of tools will set you up for failure. These tools are often out of date and not complex enough for your requirements.

Sure, I could download/create a program that scans for a specific web vulnerability and run it against 1000's of sites hoping for a hit, but for targeted attacks you need to keep the human factor involved.

That being said I think your best bet would be to start with some training courses in the security world. For example the CEH certification covers web application hacking at a high level and included with the course is a huge toolkit of exploit tools.

I still say your best bet is using a trained penetration tester that can identify and communicate the vulnerabilities effectively. This way your devs will learn from their mistakes and everyone wins.