I have read the technote entitled "What is the Blind SQL Injection vulnerability and how does AppScan test for it?" It made sense, but after sampling several Blind SQL Injection non-vulnerable variants, it appears that there are at least two other acceptable scenarios.
1. Only 1 test is run and the test is passed -- I believe this would be the case where Appscan’s first test (a true condition) is expecting the same result as the original, but gets an error page. Appscan stops testing assuming that the payload is detected and the application redirects to a custom error page, or the application can’t handle the payload and is thrown to an error page. In either case, the SQL code is not being processed.
2. The response to all tests is the same as the original – I believe this is the case where Appscan assumes the application detects the additional SQL, strips it off or ignores it, and processes the request normally.
That sounds similar to some of my Blind SQL Injection results:
I recently conducted an AppScan (v 7.8.0.2) scan for one of my web apps, which identified a Blind SQL injection security vulnerability.
AppScan asks the user to "Verify that the last test response is similar to the original response, and that the next-to-last is different."
In particular, the actual responses AppScan returned were:
Original Response = "Invalid path …… was requested" (An error message)
Test Reponse (last) = <HTML blurb>
Test Reponse (next-to-last) = <HTML blurb>
, where the <HTML blurb>s for the last and next-to-last may be the same or different.
According to the verification check, since neither of the test responses (<HTML blurb>) match the original response ("Invalid path …… was requested"), the test result may indicate that the test failed (i.e. no blind SQL injection).
I have assumed this to be a false positive … Is this assumption correct?
If I think Appscan has identified a false positive, I will reproduce Appscan's testing manually using a tool like Paros Proxy and base my decision on those results.
You can, of course, create a false positive report and send in off to the IBM Rational team for assessment. The can usually give you an answer pretty quickly.
EdG
Tags
Use the search field to
find all types of content in My developerWorks with that tag.
Use the slider bar to see more or fewer tags.
Popular tags shows the top tags for this particular type of content or application that you're viewing.
My tags shows your tags for this particular type of content or application that
you're viewing.
