I find it amusing if someone claims to be a penetration tester but he/she can’t code or write a script and relies heavily on the open source or commercial tools. Don’t get me wrong, it is fine to use freely available or commercial tools to perform what I would say ’standard operating procedures’ but there are lot of instances where you need to use your own creativity and this is one of the examples that your own tool will come handy to assist you.
In this post, I will explain how to develop your own Web Application Scanner. I promise not more than 10 lines of codes.
A typical web application scanner usually comes with three main parts:
1. Input: Input parser e.g from Burp proxy logs or a Web crawler that automatically crawls the web sites.
2. Engine: This module basically fuzz any input parameters in the site and detect any vulnerabilities.
3. Reporting: Display all the vulnerabilities in the nice format.
Because this is a Part 1, I will just focus on module 2 which is the engine and use python scripting language as an example. Why use Python? Because it’s easy and I can code less than 10 lines.
Python
——————————————————————————–
import urlib, httplib #import the relevant library
# Store all the POST Parameters in qsParams variable
qsParams = urllib.urlencode([('para','exmpl1'),(para2','exmpl2')]
conn = httplib.HTTPConnection(‘www.test.com’)
headers = {“Cookie”: ’sessionID=123456′}
# send the Post Request
conn.request =(“POST”, ‘/index.asp’, qsParams, headers)
f = conn.getresponse() # Get the HTTP Response
—————————————————————————-
Once you get the HTTP response, you can use the response to detect any vulnerabilities. For example, if you are aiming to detect SQL injection vulnerabilities, you may use regular expression to detect any string in the HTTP response to match the ‘SQL’ word.
