AppSscan Enterprise & Selenium (can you help?)

Early today I received this question:

"I've been looking for a way to integrate Appscan Enterprise with Selenium and noted some blog posts of yours that show integration with Appscan for various purposes.

I would like to know if you have any ideas on how it may be possible to glue together Selenium & Appscan.  I'm wishing there was a way to port Selenium to Manual Explore."

to which I replied:

Asking the OWASP leaders to help with my request to help Ian

Just sent this request to the owasp-leaders list:

---

This is a weird request, but there has been some great developments around O2 and IBM which could be great for our industry, and really push this area of research to the next level.

tl;dr: if you complain about the fact that SAST tools like AppScan Source don't really 'work' in the real-world, and wish they could be more customisable, please send your support, ideas, thoughts and requests to ianspiro@us.ibm.com

Please show Ian Spiro your support for his IBM AppScan research, ideas and energy

tl;dr: if you complain about the fact that SAST tools like AppScan Source don't really 'work' in the real-world, and wish they could be more customisable, please send your support, ideas, thoughts and requests to ianspiro@us.ibm.com
---------------------------------------------------------------------------------------------------

Sometimes one has to go on the record and publicly support who deserves it.

Ian Spiro is one of them.

Talking a look at how AppScan Source creates WAFL files for ASP.NET ASMX WebServices

To try to understand how to improve AppScan’s Source support for ASP.NET based Frameworks (see Ian’s post Extending AppScan's Web Application Framework to support ASP.NET MVC) a good place to start is to look at how AppScan’s Source already does (a bit of) that for ASP.NET *.asmx based WebServices (where AppScan Source is able to successfully create Tainted Callbacks for methods tagged with the [WebMethod] attribute)

AppScan Source uses the powerful IBM research technology called F4F (Framework For Frameworks) which in practice is a bunch of *.jar files that create WAFL files.

IBM AppScan eval downloads - and what is the difference between Standard, Source, Enterprise and Dynamic?

If you go the IBM AppScan download page you can see four downloads:

• IBM Security AppScan Standard V8.6 Evaluation Windows 
• IBM Security AppScan Source for Analysis V8.6 Evaluation Multiplatform
• IBM Security AppScan Enterprise Server V8.6 Evaluation Multiplatform
• IBM Security AppScan Enterprise Dynamic Analysis Scanner V8.6 Evaluation

My focus, O2 as the Open Platform, why IBM needs open standards and O2+AppScan research project

Here is an email (with minor edits) that I wrote recently to an (retired) IBMer and Bill Cheswick an Network Security guru (where I tried to answer the questions: "What are you trying to do? What is O2? and how can O2 help IBM?")

---

Hi Bill

My focus is on Web Application Security, namely on how to create secure applications.

My key objectives are to:

• enable developers to write secure code
• enable buyers/users to make informed and risk-based 'application security' decisions
• scale application security knowlege

In order to make this happen, I wrote an Open Platform (called the OWASP O2 Platform) which allows the creation of custom 'analysis engines'. These engines are created from security expert's knowledge/workflows and the output/capabilities of Application Security Tools (like the ones from IBM AppScan, HP Fortify, Veracode, CheckMarx, etc...). I am also the lead architect and developer of the TeamMentor product (from Security Innovation) which is aimed at providing hyperlinked Security Knowledge to developers (e.g. prescriptive guidance for developers mapped to corporate policies)

ASP.NET Support in SAST and IBM F4F

At the moment (Dec 2012) my understanding is that all SAST tools struggle to scan/understand ASP.NET MVC apps.

The only way to really support/understand/scan ASP.NET MVC is to map how that framework works/behaves (I don't think any SAST vendor/tool does that),  and as with any Framework, there is a lot to map:

• The controllers (equivalent to WebService's methods, which need to be marked as Tainted-Sources/Callbacks)
• The controller's authorization/authentication mappings (done using Attributes)
• The Autobinded Models
• The Views mappings (i..e what views are connected to what controllers)
• The MVC Execution life cycle
• The auto-encoding (or not) of view controls (and new display engines like razor)

O2 Light - Dual Scan and Code Fix Tag (2009)

Here is a PoC I wrote in 2009 (post OunceLabs IBM acquisition) of a mini tool (with drag-n-drop support) that:

• Fired up scans of Ounce 6 and AppScan Developer (the two SAST engines that IBM had at the time)
• Imported both set of scan Findings to O2
• Created consolidated list of Findings (i.e. findings that existed in both sets of results)
• Showed consolidated Findings to user (with ability to open them in Ounce 6)

As with the OunceLabs WebScan Module this O2 Light - Dual Scan and Code Fix Tag module (downloadable from here) doesn't build in VisualStudio anymore, but I was able to get a couple screenshots from VisualStudio's Control Designer.

O2 Presentation - from Jan 2009

Here is a presentation I delivered about O2 to OunceLabs (before the acquisition).

It's pretty cool to see the position (for O2) I had back then, and how that is still very relevant today (it's a bit depressing that the industry has not moved much in the last 4 years)

F1 How To - Scanning HacmeBank WebServices v0.6 (from 2008)

Another one from the O2 Archives, here is a pdf (shown below) that I wrote in June 2008 that showed how to use F1 (what the O2 Platform used to be called before it was Open Sourced) to scan HacmeBank Website and WebServices

Check out the consolidated graphs that I was able to create at the time. Pretty cool way to visualize multiple traces in one graph :)

The 2nd part of the document, shows how F1 was used to auto-create-callbacks (i.e. tainted sources) in the OunceLabs engine (this feature has since been added to the latest version of IBM AppScan Source)

IBM AppScan Standard, Source and VisualStudio (in the same GUI/App)

Here are some cool screenshots sent to me by an O2 user, that used the technique shown in Using a .Net/CLR, a Java/JVM and a C++ Window in another process (to show consolidated security findings) to create a GUI, where windows from AppScan Standard (.Net app), AppScan Source (Java app) and VisualStudio (C++/.NET/WPF app) are shown side by-by-side (fully functional) in an external process.

Bellow you can see the four Windows in action:

• Top Left: Findings TreeView from AppScan Standard (.Net)
• Top Right: Code Editor from VisualStudio (C++/WPF)
• Bottom Left: Trace View from AppScan Source (Java)
• Bottom Right: Guidance from AppScan Standard (WebBrowser)

Using a .Net/CLR, a Java/JVM and a C++ Window in another process (to show consolidated security findings)

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for another powerful example of consuming Chrome (and IE and Firefox) window in another process

---

Here is the video presented at OWASP BeNeLux conference, which shows how I used the O2 Platform to create a consolidated view of 3 different window's processes (one from .Net/CLR, one from Java/JM and one from C++ applications). Note that these windows are hosted by a 4th (.Net) process and are fully functional.

The objective of this 'consolidated multi-process window view', is to give developers a really strong 'vulnerability fixing environment'.

Showing Chrome, Eclipse, IBM AppScan Standard and VisualStudio in the same Process/Window

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for another powerful example of consuming Chrome (and IE and Firefox) window in another process

---

Using the control shown in Util - Win32 Window Handle Hijack (4x host panels) I was able to create a process that has windows from:

• Chrome (top left)
• Eclipse (top right)
• IBM AppScan Standard (bottom left)
• VisualStudio (bottom right)

IBM AppScan Source's and AppScan Standard's TreeViews running side-by-site in the same GUI

Using the technique described in Injecting a .NET REPL into an Unmanaged/C++ application (Notepad) I was able to create this PoC (below) where you can see both IBM AppScan Source (Java) and IBM AppScan Standard (.NET) TreeViews hosted inside a 3rd party C# based Form:

Using Jni4Net (Part 4) - Integrating AppScan with TeamMentor (first PoC)

Using the Jni4Net based  Eclipse plugin shown in the Using Jni4Net (Part 3) - Writing and Invoking O2 Methods from Java and Eclipse post, I was able to create a PoC of showing TeamMentor Guidance when a particular security finding is selected (in AppScan Source):

AppScan Source Findings in Ozasmt files (and O2 tools to View, Filter, Join, Stitch and Script them)

If you are using AppScan Source (previously called OunceLabs) you will find these O2 Tools really useful:

• Util - Simple Findings Viewer v1.1.exe (4.8Mb)
• Util - Simple Findings Viewer (with code viewer) v1.1.exe (4.8Mb)
• Util - Filter Findings by Source and Sink (RegEx) v1.1exe (4.8Mb)
• PoC - Join Traces (on Attributes) - very basic version v1.0.exe (4.8Mb)

O2's Findings Viewer on OSx viewing AppScan Source file

After O2 in OSx - Running TextBased C# REPL tool I was wondering if the O2's Findings Viewer Tool would also work on OSx, and I was pleasantly surprised when it did :)

Here it this tool in action showing the scan results of the SuperSecureBank application created by IBM's AppScan Source (OunceLab's engine).

O2 Platform AppScan Standard Plugin (first version)

Using AppScan Standard SDK here is a simple Plug-in that adds O2 Platform's Log Viewer and C# REPL environment to this AppScan menu.

Integrating Security into the User's Gui - In this case Rational AppScan Source in AppScan Standard

Based on an SI engagement I'm currently involved in, which is focused on the integration AppScan Source and Standard findings, here is a pretty cool PoC of what we are doing there:

Using O2 to help an AppScan Source (and Standard) user

Yesterday I had a great session with a potential SI customer where I was tasked to help them make the most out of AppScan Source resources.

The scenario is a very typical one for any SAST client (namely Ounce/AS.Source or Fortify):