Category Archives: Web App Sec

NTO Icon

NTOSpider 6.4 Now Available!

We are excited to announce a host of enhancements to NTOSpider that will further assist you in testing more of your applications in less time. Our mission is and has always been to create the most automated and accurate assessment possible even on the most modern applications. And, in this release, we further expand NTOSpider’s ability to effectively test modern web and mobile applications.

The following are some of the highlights of NTOSpider 6.4:

  • Web service authentication to further automate testing of web services and mobile applications.
  • Automatic update tool to enable users to automatically download new versions of NTOSpider.
  • Crawler improvements to further expand coverage of Web 2.0 applications and improved performance on very large sites.
  • Added and improved attack modules to include additional vulnerabilities in automated coverage, including Shellshock or BASH Bug.
  • Improved UI features including user defined attack policies and macro debugging.

New and Enhanced Features

  • Web Service Authentication – Expanded ability to test web services with the ability to handle the authentication and session management solutions used by many web services. Including: comprehensive OAuth, HMAC, integrated NONCE support and user defined solutions.
  • Improved Web 2.0/3.0 and HTML5 crawling – Improved automated crawling of heavy Javascript (AJAX) web sites and popular frameworks such as jQuery.
  • Enhanced performance – Performance improvements include increased scan speed and reduced memory consumption especially for very large sites.
  • Auto-updater – NTOSpider finally has a configurable automatic update mechanism that enables users to choose between three options that give the user flexibility and control over upgrades.
  • User Defined Attack Policy – Simplifies selections of attacks.
  • Macro debugger – UI feature to help user replay and debug MACRO recordings.
  • Attack modules – The following attack modules have been added or improved.
    • Shellshock (aka The BASH Bug)
    • CORS (Cross-Origin Resource Sharing)
    • XPath Injections
    • LDAP Injection
    • XML External Entity
    • Server Side Include (SSI) Injection
    • Expression Language Injection
    • ASP.NET ViewState Validation

For complete details review the release notes.

For more information or to request a free trial of NTOSpider visit:

DAST is Anything but Static

Dynamic Application Security Testing (DAST) is Anything but Static

5 Things A Modern Scanner Must Have

Dynamic Application Security Testing (DAST) solutions have been around for over a decade, so you might think the market is static. But, that’s hardly the case. Web applications and malicious hackers continue to evolve and DAST solutions need to keep pace. According to Gartner, DAST technology analyzes applications in their running state (in real or “almost” real life) during operation or testing phases. It simulates attacks against a Web application, analyzes application reactions and, thus, determines whether it is vulnerable. [Gartner Magic Quadrant for Application Security Testing, Neil MacDonald, Joseph Feiman, July 2014]

Visit this NT OBJECTives’ Gartner resource center to review some of the latest research on DAST technology.

  1. Ability to Test Web 2.0 (AJAX), Web Services, and Mobile
    Applications have evolved to be very complex and transactional – leveraging web services, mobile components and complex workflows like shopping carts. These applications are built with new technologies like HTML5 that delivers the rich clients that today’s consumers expect and REST interfaces used by AJAX. These REST interfaces also power most mobile apps, and business to business API’s. It’s critical that today’s scanners understand these new technologies.If a dynamic application security scanner hasn’t been modernized to understand these new technologies, it’s almost certainly completely skipping that area of the application leaving it untested or requiring that entire section to tested by hand. Most of the pen testers I know already have their hands full testing advanced business logic and other hard to reach areas. DAST solutions should be automatically covering as much of these applications as possible.
  2. Continuous Integration API’s to Support the SDL
    Most of the global enterprises we work with require extensibility to enable them to drive security earlier into the software development lifecycle (SDL) and to connect with existing and home grown tools. Many organizations are integrating their DAST solutions into their Continuous Integration solutions (HudsonJenkins, etc) to ensure security testing is conducting easily and automatically before the application goes into production. This requires a dynamic application security scanner that works well in “point and shoot” mode and offers open API’s for running scans. Ask your vendor how their scanner would fit into your CI environment.
  3. DEV/QA Integration and Flexible Training Options
    Security teams are collaborating with development and QA teams to leverage the test automation tools & scripts such as Selenium to create repeatable security tests that can be executed in conjunction with nightly application builds. This is an excellent way to build security into the process from the beginning with very little additional effort. Talk to your DAST scanning vendor about how their integration with Selenium and other automation tools works.
  4. Enterprise Reporting for Metrics
    Enterprise reporting means different things to different people, so one of the key features a solution should have is flexibility with open access to raw data for custom analytics. You want to make sure that your vendor does not hide the data in any way, and preferably makes it readily available with standard database query option.
  5. Point and Shoot High Quality Results
    This one is critical! Your dynamic application security scanner must do everything possible on its own to comprehensively crawl the application and then attack it. Of course training can help, but the problem is that organizations often have too many applications and the security team rarely has the time or knowledge of each application to ever possibly be able to train the scanner for them. Additionally that human time could be better spent by the security team to test things that automation cannot, such as privilege escalation and cross-account data leakage.

Ask your DAST vendor if their scanner requires training in order to understand your complex applications, and then test them for yourself.


Hackazon, new open source vulnerable web application – Sneak Peak at AppSecUSA

I hope you’ll join me next week at AppSec USA 2014 in Denver as we unveil a new open source vulnerable web application, called Hackazon in interactive group discussion, on Friday September 19th from 8:30am – 9:15am. The talk is titled, “Hackazon: Get Your App Scanners Ready.”


Many IT security professionals are concerned about their ability to adequately test modern web and mobile applications as well as web services and rightly so, because today’s modern web applications have a host of new technologies that are not being adequately tested. A critical part of the ability to test today’s applications is honing your skills and evaluating the effectiveness of the security testing tools your team uses. We have some great test applications that have served the industry as a learning platform, but these applications are dated and none of them (e.g. WebGoat, DVWA, Hackme Bank and Hackme Casino) have use cases and technologies that reflect the real world applications we are seeing today.  All of the older vulnerable web applications were built on good old GET and POST (the year 2000 called, it wants its request response traffic back). 

Enter Hackazon! Hackazon is built with the rich client and mobile technologies used in today’s applications. It’s an online storefront with an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app. And, it’s littered with your favorite vulnerabilities like SQL Injection, cross-site scripting and so on.

Hackazon enables users to configure each area of the application in order to change the vulnerability landscape to prevent “known vuln testing” or any other form of cheating. Since the application includes RESTful interfaces that power AJAX functionality and mobile clients (JSON, XML, GwT, and AMF), users will need to the latest dynamic application security testing tools and techniques to discover all the vulnerabilities. Hackazon also requires tedious testing of strict workflows common in todays business applications, like shopping carts.

During my workshop at AppSec USA, I’ll give a sneak preview of Hackazon, and seek your input as to what you’re seeing in applications and would like to see in Hackazon.

Looking forward to it! Hope you’ll join me for a lively discussion!

Hackers Only Fantasy Football League

Are You Ready for Some (Fantasy) Football?


The 2nd annual Hackers Only Fantasy Football League is back! The HO-FFL is a great way for us IT security professionals to enjoy some time together outside of the workplace. This season we have some of the leading web application security companies represented, along with AppSec consultants and users of the products.

Prior to our inaugural season last year, I discovered a bug in the Yahoo! Fantasy Football mobile app, where session tokens that would never expire and allow man in the middle attacks to hijack them – to be used to their advantage against their rivals. The bug has since been fixed by Yahoo!.

This season is fired up and ready to start. The teams were drafted on Friday and now we eagerly await the start of the season tomorrow. We have an amazing collection of bright minds in the InfoSec industry that will battle head to head this season for the inaugural trophy.


Along with myself, we have several returning players

  • Billy’s Team – Billy Austin from iScan Online’s returns as our defending champion. He just so happened to draft the highest scoring player from 2013, Peyton Manning. Billy happens to be my first opponent. I’m hoping that Peyton doesn’t repeat his Week 1 performance from last year when he threw for 7 touchdowns against Baltimore.
  • Hash Crackers – Lee Carsten and Patrick Adams of the Denim Group took a distant second place last year, but got the top score for their draft this year.
  • Tomball Cowboys – Michael Farnum from competitor HP and founder of my favorite local conference, HouSecCon. Farnum’s draft grade was the worst, and asks’ did “Tomball Cowboys Throw the Draft on Purpose?
  • Megatron – David French of Risk I/O who decided to chase Farnum down toward the bottom with his grade stating that “Megatron Obviously Hates Winning”.
  • Boca Steelers – Alan Shimel currently of The CISO Group and formerly of StillSecure. And before that Alan was hanging with Al Gore helping to create the Internet….and before that he was with Edison harnessing electricity.
  • brb…. Football 0x2 – The one and only SecBarbie aka Erin Jacobs of UrbaneSec.
  • Man vs FF – Finally myself, Dan Kuykendall from NT OBJECTives. The yahoo score nicely sums up my draft this season “Despite a Formidable Set of WRs, Man vs FF Has Roster Filled with Meh”.

We have a few new players this year

  • Pfeil Not Found 404 – Kenneth Pfeil of Pioneer Investments who comes in with one of the coolest team names.
  • OR mattjay=mattjay – WhiteHat Security’s very own, Matt Johansen. Only fantasy football can bring together so many competitors.
  • Lobotomy Sleuth – Kenny Herold of Cargill one of the world’s largest, privately-owned businesses.
  • Broadmoor Trash – Joe Sanders of Equifax (I hope when I beat him in week 4, that it doesn’t hurt my credit score!).
  • Orange County Bears – Dmitriy Kashitsyn the Director of Engineering at NT OBJECTives. Dmitriy made me worry during the draft when he asked “What does QB mean?”. Hopefully he busts out his ‘Football for Dummies’ book quick!

We will have a few opportunities to get together and share drinks and catch up (or smack talk) at events such as OWASP AppSec USA (9/17-9/19), HouSecCon (10/16) and RSA 2014 (2/24/2015-2/28/2015). These are great chances to see familiar faces and build upon new relationships built over the bond of Fantasy Football!

1.7 Automation Reduces Man Hours

Application Security Scanning Today – Big Organizations, Big Challenges

IT security teams in global enterprises face significant challenges in application security scanning that create the need for application scanners to deliver a scalable solution that is capable of assessing today’s applications. At NT OBJECTives, most of the organizations we talk to and work with are some of the largest organizations in the world. They are dealing with tremendous challenges from numerous applications and limited resources to ever changing technology. Let’s examine the three key challenges many of our customers face.

1. Complex Applications, New Technologies

One of the primary challenges in application security testing today is the complexity of modern applications.

“The surface of attacks targeting applications and data has expanded from Web into mobile and cloud systems. Rapid adoption of detection and protection concepts and technologies is critical for all enterprises.”
Section from Gartner other report on market state
Hype Cycle for Application Security 2013, July 25, 2013

Today’s applications are written in different technologies and those technologies are constantly changing and evolving. In the early 2000’s, most applications were simple HTML applications. Now with Rich Internet Applications (RIA’s), mobile and cloud applications, we have a host of new technologies used in applications. These technologies include everything from AJAX and Google Web Toolkit to REST and JSON.

Most application scanners have fallen behind the innovation curve and can no longer automatically or accurately assess applications that include these technologies, leaving enterprises vulnerable.


Scanners were historically based on their ability to crawl an application in order to understand it and they were able to crawl HTML, but this is no longer the case. A new architecture and approach is required for these newer technologies. From what I can tell, NTOSpider is the only that has been modernized to address today’s applications. Be sure to examine your application security scanner carefully to determine if it’s covering the newer technologies. To read more about dynamic application security tool coverage of new technologies, please check out our white paper, “Is Your Scanner Like the Emperors New Clothes?”.

2. Enterprise Scalability & Automation

Compounding this issue of the complexity of applications is the sheer volume of them. Today’s enterprise security teams are faced with the enormous challenge of securing hundreds or thousands of applications, built in a variety of technologies with small security teams.

In order to effectively secure that many applications, security teams require a high-level of sophisticated automation. We often refer to the breadth of scanner coverage – is it covering this AJAX corner of the application, or that complex business workflow.

Considering Application Security Scanner Coverage

Application scanner coverage is the percentage of an application that a scanner can automatically understand and test. As an application scanner’s coverage of applications increases, costs for scanning all of the organizations application’s decreases. In order to achieve maximum scalability, organizations should use maximum automation. Maximum automation is derived from maximum application coverage by a scanner. There aren’t any application scanners that can scan 100% of a complex application because they will always require some testing by hand for certain business and application logic functions. However, scanners should be able to achieve maximum coverage of a complex application. Roughly 80% of a security test, even on a complex application, is capable of being automated.

For this discussion, I’m using a sample organization that has 80 standard applications and 20 complex applications.  The potential cost savings of using an application scanner with maximum coverage available (80%) would be about $228,000 or 1520 man hours per scan cycle. Many organizations do quarterly cycles, so this can result in a savings of approximately $1m per year. The following tables and graphs demonstrate the business case for maximum automation.

Cost Savings Driven by a Highly Automated Scanner for 20 Complex Applications

The table below details the time and cost savings realized with improved automation (scanner coverage) for one cycle of testing for the 20 complex applications. Using this rough estimation technique, you can see that an organization can save $80,000 in one testing cycle where 20 complex applications are tested one time.

For the purposes of this example, I am estimating the cost per pen test hour at $150 and estimating the man hours required to complete a scan based on the coverage the application scanner can provide and the complexity of the application. The estimated total man hours required for testing the applications is multiplied by the $150 to get the cost for the apps for each row.

The following table demonstrates how total security testing costs decrease for 20 complex applications as the application security scanner’s % coverage of the application increases.

1.0 Time & Cost Savings for Complex Applications

Note: The column called, “Man hours required to complete a scan” refers to the total number of human hours required to assess an application including: configuration time, pen testing time, vulnerability review and validation time, etc.

So, if we look at the same cost savings for 20 complex applications in a graph, we can see that as scanner automation improves, costs decrease. 

1.1 1.1 Cost Savings with Improved Automation (20 Complex Apps)

Cost Savings Driven by a Highly Automated Scanner for 80 Standard Applications

So, does the same logic hold true for more standard applications that are less complex? This table details the time and cost savings realized with improved automation for 80 standard applications over one test cycle. Again, using this rough estimation technique an organization can save $72,000 in one testing cycle where 80 standard applications are tested one time.

1.2 1.2 Time & Cost Savings for Standard Applications

Again, looking at it in a graph format, you can see that as scanner automation improves, costs for testing 80 standard applications decreases. With 50% coverage, the applications will cost around $120,000 to test, but with 90% coverage, the costs decrease to less than $20,000.

1.3 1.3 Cost Savings with Improved Automation (80 Standard Apps)

Cost Savings Driven by a Highly Automated Scanner for 100 Mixed Complexity Applications

So, when you look at all 100 applications of mixed complexity, again we see that as scanner coverage increases, man hours and therefore overall costs, also decrease.

1.4 Time and Cost Savings (100 apps, mixed complexity)

And the graph demonstrates that  an organization can save almost $200,000 by testing all 100 of their applications one time with maximum automation as opposed to 50%.

1.7 Automation Reduces Man Hours

3. Scalability with Cost Control

A third major issue is that most of these organizations are building world class application security programs to address thousands of web and mobile applications with limited financial and human resources in a race against ever increasing threats. This challenge requires them to find highly automated and distributed application scanning solutions while effectively using resources to control costs.

But controlling costs is difficult. The smartest solution is one that combines the most accurate and automated web application vulnerability scanning with the benefits of elastic computing in the cloud to provide a sophisticated and scalable solution that effectively controls costs while conducting automatic vulnerability detection for even the most complex applications. Our scalable, elastic solution leverages NTOEnterprise and enables the largest global enterprises to provide their own application security assessment shared services to their customers or different divisions around the world.

A highly sophisticated and automated solution combined with elastic computing enables global organizations to easily expand and contract resources based on their scanning demand.

At NT OBJECTives, we have always strived to maximize automation. We find that many of the largest organizations in the world choose us because the complexity of their application security program necessitates sophisticated automation, maximum application coverage and scalability. For more information about how we solve these problems, please visit us at or request that we contact you by filling out this short form.


Mobile application security testing – fast and easy!

Mobile-App-SecMobile application security testing: Four words that, for many security professionals, elicit a nagging feeling that comes from knowing the challenge is imminent if not already present, yet very difficult to tackle.

We at NT OBJECTives understand, and we’ve got your back. Our newest service offering is designed to help busy security teams easily and thoroughly test mobile applications – without intensive training or resource drain.

NTOMobile On-Demand gives NTOSpider customers everything they need to quickly security test mobile applications, including mobile client native code and back-end web services. No need to choose between testing the source code, testing the services or pen testing the mobile app. NTOMobile On-Demand does it all with a comprehensive software solution combined with expert pen testing.

Comprehensive mobile application testing requires both static and dynamic analysis, so we’ve packaged them together, along with expert pen testing, to deliver comprehensive mobile application security testing. By leveraging the power of NTOSpider’s dynamic application security testing capabilities, NTOMobile On-Demand effectively and automatically tests the web services that power mobile back ends and that leverage new technologies like REST, JSON and SOAP. You won’t find another web application security testing solution that delivers better coverage of your custom web service implementations.

Mobile application security testing is a challenge for security teams that don’t have the time or resources to invest in effective training and tools. NTOMobile On-Demand enables security teams to conduct comprehensive mobile application security testing – and obtain the peace of mind that comes from doing what needs to be done.

Mobile Apps

How to Overcome the Shortfalls of Web Application Security Scanners when Testing Mobile & Rich Internet Applications

Mobile AppsYou’ve built a custom rich internet application that is sure to become your business’ next major revenue stream. Conscious of security, you’ve ensured that the native application authenticates to the server, and you’ve run the app through a web application security scanner to identify weaknesses in the code. Those vulnerabilities have been remediated, and now you’re ready to go live.

Not so fast.

Despite your best intentions, chances are good your rich internet application is going live with dangerous security flaws. Most traditional web application security scanners and authentication methods do not provide the necessary protection when you’re dealing with modern application architectures, data formats and other underlying technologies. However, you can still build state-of-the-art rich internet applications with reliable and safe web application security by following these simple steps.

Step 1: Understand your chosen technology and its security requirements.

Classic HTML applications are no challenge for web application security scanners because that’s what they were originally built to do. However, rich internet applications based on newer technologies like AJAX, JSON and REST are a different story –,most security scanners do not support these new formats unless they’ve been re-architected. Due to the heavy use of JavaScript or complete lack of HTML, these new application formats and technologies make it nearly impossible for scanners to crawl an app. Plus, mobile applications further complicate matters because they often use web services which cannot be crawled at all.

To make matters worse, attackers are finding new ways to exploit application programming interfaces (APIs) associated with mobile applications. Web application session management techniques fail to deliver the protection developers expect, and these old and insecure techniques do not stop attackers from tampering with the application, committing fraud or performing man-in-the-middle attacks.

Therefore, it is important to understand the technologies used in your rich internet applications so you can find an appropriate web application security scanner and/or supplement your scanning efforts accordingly. Below is a list of the technologies that may require a more in-depth security solution:

  • AJAX applications: JSON (JQuery), REST, GWT (Google WebToolkit)
  • Flash remoting: Action Message Format (AMF)
  • HTML5
  • Back end of mobile apps powered by JSON, REST and other custom formats
  • Web services: JSON, REST, XML-RPC, SOAP
  • Complex application workflows: Sequences (shopping cart and other strict processes) and XSRF/CSRF tokens

Step 2: Understand the vulnerabilities of rich internet applications.

There are two key qualities you should require of a web application security scanner that you plan to use for modern rich internet applications. The first is the ability to import proxy logs. The second is an understanding of mobile application traffic, which enables the scanner to create attacks to test for security flaws. Vendors are often quick to advertise their scanners’ ability to be fed data from a proxy, but if the scanner is not familiar with JSON and REST, it will not be able to create attack variations – even when fed recorded traffic.

Like web application security scanners, traditional authentication methods fail to deliver the protection they once promised. While historically used to protect server-side mobile applications from SQL injection and cross-site scripting attacks, today’s authentication methods simply aren’t sophisticated enough to provide adequate web application security to new rich internet applications and mobile apps. For example, attackers can exploit weak passwords when a scheme only authenticates the user and not the application. This can be avoided by using a client-side certificate to identify the application, but this isn’t feasible for all apps – especially customer-facing mobile apps.

Step 3: Determine whether your web application security scanner is capable.

You can – and should – ask your web application security scanner provider what technologies the tool is able to scan. But don’t leave it at that – verify what they say is true. For instance, you can test for the security scanning coverage of an AJAX application by analyzing the request/response traffic. To do so, simply enable the scanner’s detailed logging feature, run the scanner through a proxy like Paros, Burp or WebScarab, and save the logs for manual review.

JSON also poses a unique challenge to web application security scanners. They must be able to decipher the new format and insert attacks to test the security of web application interfaces. A review of detailed logs of request/response traffic will indicate whether the web application security scanner is fully capable of protecting rich internet applications like yours. However, not all web application security scanners provide detailed logging. If this is the case, you will need to set up a proxy to capture traffic during the scan. Begin by scanning only a page that uses JSON, then check to see if the scanner requests include the JSON traffic and requests.

Step 4: Bolster manual testing efforts and custom web application security models.

Attackers are increasingly targeting back-end servers. And while new mobile APIs like JSON create new ways to engage customers in rich internet applications, they also create new ways for attackers to reach back-end servers. The only way to discover and remediate API security flaws, authentication weaknesses, protocol-level bugs and load-processing bugs is with several rounds of testing. Also, understand that you cannot rely on SQL or basic authentication to protect the back end. Develop server-based applications to anticipate attacks by continually verifying the integrity of the application and uptime environment.

Finally, when developing rich mobile applications, keep the following tips in mind:

  • Data provided by the client should never be trusted.
  • A device’s mobile equipment identifier should never be used to authenticate a mobile application, but do use multiple techniques to verify that requests are from the intended user.
  • Because session tokens for mobile apps rarely expire, attackers can use them for a very long time.
  • Credentials should not be stored in the application’s data store, local to the device.
  • When requiring SSL, a valid certificate should be necessary.

Guaranteeing reliable web application security for rich internet applications and mobile apps can be tricky business. However, completing the proper research, choosing the right security scanner, and performing an ample amount of testing will help detect vulnerabilities and ward off new attacks, allowing your application to be successful in the marketplace.

Application Workflows

Web Application Security Testing for Complex Workflows. Not so Complex Anymore.

Conducting web application security testing for complex workflows can be a real pain. In order to find vulnerabilities, valid test data must be passed through exactly as the workflow prescribes. Most web application security testing scanners aren’t up for the job, so security testers must supplement their scans with manual testing.

If your organization has just a couple applications that aren’t changing, then manual testing may not be a big deal, but that’s rarely the case. Many large organizations have hundreds or thousands of web applications. Manually security testing all of them can be expensive and time consuming – requiring resources that your organization simply doesn’t have.

We understand, and have enhanced NTOSpider to address this pain point. Today, we announced that NTOSpider is now the first web application security testing scanner capable of understanding complex workflow sequences and the expected results, which enable it to automatically create relevant session states and find web application vulnerabilities. Bottom line: With NTOSpider, security teams can automate the security testing of complex workflows – saving a tremendous amount of time and finding more vulnerabilities sooner!

In order to understand the significance of NTOSpider’s update, it helps to understand how traditional scanners fail to test complex workflows. Most web application security testing scanners are built to conduct an assessment in two phases: a crawl phase and then an attack phase. During the crawl phase, the scanner gathers information about the application’s attack vectors. The scanner develops an understanding of the application’s landscape, including the pages and inputs on each page. Scanners then use the information gathered by the crawl to randomly attack pages.

Application Workflows

It’s best to attack most web application functionality randomly. However, this isn’t the case for complex workflows. In order to find vulnerabilities, valid test data must pass, in order, through the prescribed workflow. Attacking workflows at random isn’t effective. When the web application security testing scanner attempts to attack the shipping page without adding items to the cart, for example, the application generates an error without accepting the scanner’s attack, because there are no items in the cart. Unfortunately, the scanner is unaware of the error and misses vulnerabilities as a result.

Security testing the workflow in order is one important piece of the equation, but it’s also critical to test the entire workflow. Scanners, like hackers, submit various kinds of attacks. One kind of attack is SQL injection. In a SQL injection attack, the hacker or scanner enters a malicious SQL statement as an attack through the last name field instead of entering an actual last name. So, in this example, the malicious attack is entered through the ‘last name’ field on the billing form. The application then holds that data in temporary storage until the user confirms the order. It is not until the order is confirmed, that the information is sent to the database (SQL server) and the SQL vulnerability could be detected by the scanner. So, if complex workflows aren’t tested in their entirety vulnerabilities won’t be found, in this case, a vulnerability in the ‘last name’ field wouldn’t be found.

For these reasons, most web application security testing scanners are unable to effectively attack complex application workflows in their entirety and in the prescribed application workflow. Scanners need to be architected in a way that they can handle both kinds of security testing for complex workflows where both order and completeness are critical. NTOSpider understands and respects application workflows so that attack payloads are delivered into the application code where the scanner can discover vulnerabilities.

It can be costly and difficult to accurately test all complex workflows in today’s applications. NTOSpider gives you the ability to find vulnerabilities automatically, with more accuracy and in less time.

This new release of NTOSpider holds just one of many innovations that we are working on when it comes to automating web application security testing.

We understand how difficult and frustrating running a web application security testing program can be. Stay tuned! Our roadmap has many exciting advancements in store. We are committed to continued innovation and advancements that you won’t see anywhere else!

Information Security Podcast

An Information Security Place Podcast – 01-22-14

Jim, Dan, and Michael have a lot of catching up to do. We talk about a lot of stuff because a lot of stuff has been happening. From RSA, NSA, QSAs… security is busy! Show notes below!

Show Notes:

Infosec News Update

  • 123456 is the new best of the worst – Link
  • RSA Conf and those skipping it this year – Link
  • Fixing a flawed VA medical records system: Tenacity pays off for a researcher – Link
  • Do you believe the Obamacare website is secure? These guys don’t – Link1, Link2, Link3

Discussion Topic – The Failure Themes of the Target Breach

  • Massive Props to Brian Krebs on his coverage of the whole debacle –
  • AntiVirus Takes it on the Chin …Again – Link
  • Egress Filter Much? – Link
  • Credit Card Processing Fundamentally flawed – Link

EMPHATIC POINT OF THE PODCAST!! Complacent with Compliance … again PCI!= security

Music Notes

Special Thanks to the guys at RivetHead for use of their tracks“

  • Intro: “Stay Alive“ – Rivethead
  • Segment 1: “Synchroncity II“ – RivetHead
  • Segment 2: “Burn Us Down“ – Early Morning Rebel
  • Outro: “Zero Gravity“ – RivetHead
New Technologies in WebApp Sec

Webcast: SQLInjection Vulnerabilities Hidden in New Places

Why are your applications still suffering from SQL Injection Vulnerabilities?

Even though we know so much about SQL Injection, we have a perfect storm brewing for serious security problems in many modern applications. The perfect storm is brewing because the younger generation of developers who are building these new applications in technologies like JSON, REST, SOAP and AJAX aren’t experienced in security and the security professionals who need to test them aren’t experienced in these formats.


To make matters worse, business managers are under pressure to get these applications out quickly which often results in inadequate security testing. And then we have the scanners. Most scanners were built to scan classic HTML based apps.

Please join me next week on Wednesday, October 16th as I share what I have learned after two years of testing “modern applications.” such as mobile, RIA’s and web services. I will demonstrate that they are susceptible to all the same SQL Injection mistakes of the past.

This webcast is designed for both developers and security professionals who want to learn more about how SQLInjection and other vulnerabilities hide in these modern formats. I will go through each format, review how to understand it and how to find vulnerabilities in it. Finally, I will discuss how to scale testing on these kinds of applications in an automated way.

Join me for this webcast to learn

  • Why SQL Injection is so prevalent in these technologies despite the fact that we have understood SQL Injection for so long.
  • How to understand these newer formats (JSON, REST, SOAP) and find SQL Injection vulnerabilities in nine technologies commonly used in these applications.
  • How you can scale your testing to automatically find these vulnerabilities.

Finally, we’ll discuss how you can scale your testing with automation to automatically find these vulnerabilities.

See more at: