Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cenzic's Hailstorm: Page 2 of 4

No vulnerability assessment product finds all the holes in AJAX, SOAP and conventional Web apps. But Hailstorm competitors such as SPI Dynamics' WebInspect and Watchfire AppScan Audit have long been able to scan for Web application vulnerabilities to SQL injection attacks and buffer overflows in Web services and XML, and they're ahead of Cenzic in their ability to seek out SOA vulnerabilities. However, the rivals - with the exception of SPI Dynamics - don't address AJAX issues, such as authentication and authorization of dynamic links to scripts on the server; nor do they handle session-based vulnerabilities as well as Hailstorm.

Hailstorm's AJAX-specific security assessment capabilities are available as an update to the latest version. There's not much outward indication of the product's AJAX support other than the ability to edit AJAX request formats in the same way it offers editing of SQL injection strings. Hailstorm scans for AJAX vulnerabilities whenever it encounters an AJAX-enabled site. The product must be configured to test for security holes relevant to the technology, such as SQL injection, authentication and authorization, and a limited number of XML structural vulnerabilities.

Hailstorm does not perform signature-based scans. Instead, the program uses its internal Firefox browser to detect errors based on actual responses received. With AJAX-enabled sites, Hailstorm performs a complete XML structural analysis of the pages. First, the product retrieves pages with appropriate data, then it purposefully injects errors into the requests and evaluates the response based on the original correct response. This technique lets Hailstorm detect vulnerabilities that allow attacks such as privilege escalation, which generally appear on a page as additional options that are structurally correct.

The use of an internal browser lets Hailstorm perform session-based assessments of vulnerabilities such as session hijacking, which cannot be discovered using signature-based scans. There are drawbacks, however, to using its Firefox browser as the medium for vulnerability assessment, as it is unable to detect security holes in VBScript or Microsoft-specific technologies like ActiveX. As a workaround, Hailstorm provides a proxy-based scan that employs Internet Explorer for these technologies.