Sprajax? Security Scanner for AJAX

Dietrich Kappe, Monday, May 29, 2006 @ 9:00 am

I came across an open source AJAX security scanner called Sprajax. From the Denim Group's press release:

Sprajax is the first web security scanner
developed specifically to scan AJAX web applications for security
vulnerabilities. Denim Group, an IT consultancy specializing in web
application security, recognized that there were no tools available on
the market able to scan AJAX. AJAX allows web-based applications a
higher degree of user-interactivity, a feature with growing popularity
among developers.

Denim Group developed this innovative tool that
will revolutionize security assessments by providing a more thorough
diagnosis of security vulnerabilities within the AJAX code that other
web security scanners are not designed to read. The software then
produces a report of possible weaknesses for developers to remedy.

It's Open Source, so I decided to download it and see what the hype was about. First, the application is written in C#. Second, you will need SQL Server to get it to run as the results are stored in SQL Server and are pulled into reports using stored procedures. Finally, the application doesn't do all that much.

The application takes an application URL as a parameter and has three main functions.

• You can "footprint" the application, i.e. scan it for Javascript files and web services.
• You can "fuzz" the application, i.e. pass garbage into the web services to see if they will barf.
• You can display the results of the previous two functions.

Essentially, the footprint function spiders the application, detects the framework used, finds Javascript files included, and discovers web services used. The fuzz function uses those discovered web services and passes some garbage into them and sees if they returned error conditions. There are just a few problems with this tool, however:

• The tool only detects the Atlas framework. No Dojo, DWR, etc.
• It only detects SOAP web services used by the Atlas framework. No REST, no framework specific calls.
• It doesn't scan the Javascript files for XHR calls, another place to find calls back to the server.

The fuzz function only tests robustness and in a fairly limited way, i.e. will the app go belly up when you pass in garbage data. Typically, security scanning tools test for known exploits of web application frameworks, a much more useful approach.

Finally, consider that many AJAX frameworks make use of dynamic XHTML and Javascript to drive content and navigation. This tool just sucks in the content and looks for URL's. It wouldn't find even one link in an Echo2 application, for instance.

Overall, there isn't much here. It has the feel of something that a journeyman programmer put together over a weekend. I applaud the Denim Group for releasing an Open Source tool, but the hype in their statement is wildly inaccurate. You can likely write something in Perl in a few hours that would do all of this and more.

agile ajax

Comments: 1 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   I wrote the sprajax tool so I thought I would respond. That is a fair assessment of the tool in its current state. This is certainly an “alpha” release but work is progressing. Next up for sprajax:

   -Remove requirement for SQL Server 2005 - this is a huge barrier to getting more folks using the tool and being able to look at historical scan data from a database is a lower priority at this point than making it easy to get up and running.

   -Add support for the Google Web Toolkit. The interfaces for detecting, footprinting and then fuzzing frameworks need a little bit of work, but the goal is to make these fairly generic and modular so that it is easy to add support for additional AJAX toolkits. I suspect that once I have Atlas and GWT working it will be much easier to add support for DWR and others. And it should also be possible at this point to add more scanning for other non-framework-defined endpoints for additional fuzzing.

   I would however disagree that looking for known exploits would be a better approach than the fuzzing sprajax does right now. Tools like Nessus and Nikto already serve this function quite well - they can tell you if your server is misconfigured or using out of date software. The point of sprajax is to try and find flaws in the custom code written using these frameworks so it exercises the application and analyzes request and response patterns. This approach is good for finding “technical” flaws in applications usually based on coding flaws and bad input handling, but isn’t very good at finding “logical” flaws in applications. Unfortunately there really aren’t any good tools for finding “logical” flaws in the design assumptions of applications other than manual inspection and design review. So we automate what we can…

   Sprajax has a place in assessing the security of AJAX-enabled web applications. The press release might not have done a good job of pointing out its limitations - they never do - but sprajax is still under development and its utility should grow over time.

   Thanks,

   –Dan

   Comment by Dan Cornell, Thursday, June 1, 2006 @ 1:28 pm

Leave a comment