Qualys, Inc. · NASDAQ:QLYS
Qualys — Technical Presentation (2021)
93 slides from Qualys's technical presentation, 2021
Slide 1: Qualys Web Application Scanning
Qualys Web Application Scanning
Slide 2: Training Documents
Training Documents • Download the Presentation Slides and Lab Tutorial Supplement from: • Qualys Sharepoint site - https://bit.ly/qsc2021-was
Slide 3: Lab Tutorial Supplement
Lab Tutorial Supplement • All lab activity for this course is performed in a simulated lab environment • Please refer to the WAS Lab Tutorial Supplement for the following: • Link to start the lab (each lab topic has a separate link) • Overview of the steps performed for each topic • Additional suppo
Slide 4: Additional Reading
Additional Reading • WAS Getting Started Guide - https://www.qualys.com/docs/qualys-was- getting-started-guide.pdf • WAS API User Guide - https://www.qualys.com/docs/qualys-was-api-user- guide.pdf
Slide 5: Agenda
Agenda q WAS Overview q Basic Web Application Setup and Discovery q Advanced Web Application Setup and Scanning q API Testing q WAS Reporting q Tagging and Users q Burp and Bugcrowd Integration q Malware Detection
Slide 6: Web Application Scanning Overview
Web Application Scanning Overview
Slide 7: WAS Overview
WAS Overview Automated Testing (Fault Injection) • Submit “specially crafted” characters • Observe the server’s response • This represents 80 – 85% of Web app vulnerabilities Manual Testing (BURP Integration) • Automated tools effectively detect Web application bugs (SQL execution inside user input)
Slide 8: What Do Automated Tools Miss?
What Do Automated Tools Miss? Logic Errors: Point of authentication vs. point of authorization • Forced Browsing Links - user forces access to unauthorized link. Permission Errors: File system permissions have a significant impact on application security. • Public file share that has employee payrol
Slide 9: Qualys WAS Lifecycle
Qualys WAS Lifecycle 1. Define the Application 4. Report 2. Discovery Scan 3. Vulnerability Scan
Slide 10: Qualys Cloud Platform
Qualys Cloud Platform IaaS Providers Web App QUALYS Internal Scanner PLATFORM ü Strong Data Encryption ü Firewalls ü IDS ü TLS communications Internal External Scanner Pool Web App External Web App Qualys User Corporate Environment
Slide 11: KnowledgeBase and Search Lists
KnowledgeBase and Search Lists
Slide 12: What do we check for?
What do we check for? Web Application Scanning v Help~ — StyamRaj v Logout Dashboard Web Applications Scans Detections Reports Configuration KnowledgeBase KnowledgeBase KnowledgeBase =a ree [be ov GS = aw 3 name Information Category Severity 4 Filter Results Clear At a 150125 File Upload Form Found
Slide 13: Web App Vulnerabilities
Web App Vulnerabilities Confirmed Vulnerabilities Potential Vulnerabilities Sensitive Content Severity Level Description a Minimal be at bg ood Medium formation, intruders can ea Severity Level Description ‘el Minimal ‘ahs Medium Severity Level Description ao Minimal cial security number. TI ale Med
Slide 14: Search Lists Overview
Search Lists Overview User-defined Groups of QIDs • Static search list - Manually defined • Dynamic search list - Criteria-based Benefits • Dynamic List updates when new QIDs meet the search criteria • No limitation to the number of QIDs in search list
Slide 15: Search Lists Overview
Search Lists Overview Search lists allow you to modify the vulnerabilities for which you are: • Scanning • Reporting Example: • Run a scan for only SQLi • Exclude a vulnerability from a scan • Build a report for only XSS
Slide 16: Lab 1 and 2
Lab 1 and 2 Please follow pages 3 – 5 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc2021-was 15 min. Lab 1 – KnowledgeBase Lab 2 – Search Lists
Slide 17: Basic Application Setup and Discovery
Basic Application Setup and Discovery
Slide 18: Defining an Application
Defining an Application An application is: • A business function typically requiring login • Running unique code
Slide 19: Defining Applications – Unique Business Process
Defining Applications – Unique Business Process Example site: http://site/admin/ http://site/hr/ http://site/finance/ Scenario 1: Scenario 2: • Each directory is • Authentication part of a single credentials are app if they are different for each, part of an Intranet with different Portal business f
Slide 20: Defining Applications – Different ports
Defining Applications – Different ports Example site: E-commerce site that authenticates over https, allows browsing over http a catalog: Scenario: • WAS users only need to define the https://e-commerce:443/login.cgi starting port. http://e-commerce:80/browse.cgi • The scanner will discover all port
Slide 21: Defining Applications – Different Ports
Defining Applications – Different Ports Example site: http://intranet:80/index.cgi http://intranet:8080/index.cgi Scenario 1: Scenario 2: • If the app on port • If app on port 80 80 has links to app doesn’t have links on port 8080 to port 8080 • Links are same • Links are different business function
Slide 22: Defining Applications – Different hostnames
Defining Applications – Different hostnames Example site: http://production.domain:80/ http://qa.domain:80/ Generally considered 2 applications because they are separate hostnames
Slide 23: Web Applications - Filtering
Web Applications - Filtering Filter your apps by: • URL • Tags • Scan information • Last Scan Date • Last Scan Status • Scanner Appliance • Scanner Appliance Tags • Authentication Record • Custom Attribute • Creation Date
Slide 24: Web Applications – Bulk Edit
Web Applications – Bulk Edit Bulk Edit: • Owner • Scope • Option Profile • Scanner Appliance • Header Injection • Authentication Record
Slide 25: Removing Web Applications
Removing Web Applications Used to remove retired Applications Like VM, does a full purge for that web app within Qualys
Slide 26: Crawl Scope
Crawl Scope
Slide 27: Crawl Scope
Crawl Scope Web Application Edit: My First App Edit Mode Asset Details Scan Settings Crawl Settings Redundant Links Tell us about the web application you want to scan Target Definition Web Application URL (or Swagger file URL) https: / /demo06.s02.sjc01.qualys.com/ Crawl Scope* Limit to content loca
Slide 28: Scope – Limit to URL hostname
Scope – Limit to URL hostname Select this to crawl the hostname within the URL using http or https and any port Example: http://www.example.org/new • All links in the http://www.example.org domain will be crawled http://www.example.org/support http://www.example.org:8080/news • Links from www.exampl
Slide 29: Scope – Limit to content at or below Sub-directories
Scope – Limit to content located at or below Sub- directories We can limit crawling to the starting URI and its sub-directories.
Slide 30: Scope – Limit to URL hostname and specified sub-domain
Scope – Limit to URL hostname and specified sub- domain We can limit it to crawl only sub-domains
Slide 31: Scope – Limit to URL hostname and specified domains
Scope – Limit to URL hostname and specified domains We can crawl the starting URL, and the additional domains
Slide 32: Scanning
SYer-Talaliare)
Slide 33: Scan Types
Scan Types Discovery Scan • All links are determined • Authentication is maintained during the scan • Links with forms are set aside for vulnerability assessment Vulnerability Scan • Should happen after at least one Discovery Scan • Tests the web application for vulnerabilities
Slide 34: Discovery Scan
Discovery Scan
Slide 35: Discovery
Discovery 1. Scan begins at starting URL identified in the application definition 2. Using the Scope Options identified in the application definition, the scan traverses links to discover pages and content 3. Configuration data is collected from the target app and its host 4. Vulnerability testing i
Slide 36: QID 150009 - Links Crawled
QID 150009 - Links Crawled QID 150009 Links Crawled lists all links that have been crawled
Slide 37: Web Application Sitemap
Web Application Sitemap View Web Application or Scan Sitemap To: • View Pages Crawled and Vulnerability Statistics • Create New Web Apps • Add URLs to Black List • Add URLs to White List
Slide 38: Lab 3, 4 and 5
Lab 3, 4 and 5 Please follow pages 5 – 14 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc2021-was 20 min. Lab 3 – Create Application 1 Lab 4 – Create Application 2 Lab 5 – Scheduled Scans
Slide 39: Advanced Application Setup and Scanning
Advanced Application Setup and Scanning
Slide 40: Option Profile - Crawling
Option Profile - Crawling Crawl stops when: • Max number of links threshold is met • No new links are discovered • Scan time-out is reached
Slide 41: Option Profile – Scan Parameters
Option Profile – Scan Parameters • Modify Form submission for GET, POST, GET&POST, None • Change User agent • Create Parameter sets • Ignore common binary files • SmartScan Support • Change Behavior and Performance settings • Modify Bruteforcing settings
Slide 42: Option Profile – Enhanced Crawling
Option Profile – Enhanced Crawling • Improves scan coverage by re-crawling individual directories present in the links found during crawling • Uses a directory chopping approach
Slide 43: Option Profile – Enhanced Crawling
Option Profile – Enhanced Crawling • Starting URL – https://www.example.com/foo/abc/xyz/register.php • First request – https://www.example.com/foo/abc/xyz • Then crawl – https://www.example.com/foo/abc • Then crawl – https://www.example.com/foo
Slide 44: Option Profile - SmartScan
Option Profile - SmartScan • Used for enhanced AJAX or Single Page Applications (SPA) • Supports sites using AngularJS and bootstrap • View QID 150148 to see links crawled – this will be your hint to verify SmartScan is working
Slide 45: Option Profile – Behavior Settings
Option Profile – Behavior Settings Timeout Error: Network connectivity or someone reboots a server Unexpected Error: Web app returning 500/Internal Server Errors If a threshold is met, your scan will give you a “Service Errors Detected” status
Slide 46: Option Profile – Keyword URL Search
Option Profile – Keyword URL Search • Search for URL links that contain specific keywords • Keywords are searched in internal links during Discovery/Vulnerability scan • Links containing the specified keyword are shown under QID 150141
Slide 47: Option Profile – Bruteforcing
Option Profile – Bruteforcing • Performed when Form Authentication is used • Make sure you include QID 150049 • Use Qualys list or import your own
Slide 48: Web Application - Explicit URLs to Crawl
Web Application - Explicit URLs to Crawl • Specify URLs you want the service to crawl • Useful for pages not linked to other pages in the application
Slide 49: Web Application - Progressive Scanning
Web Application - Progressive Scanning Works best with Frequently Scheduled Scans
Slide 50: Web Application - Progressive Scanning
Web Application - Progressive Scanning • Performs ‘look back’ at previous scans • Prioritizes pages not previously crawled • Prioritizes new functionality • Includes vulnerable pages detected previously • Enhances flexibility in scheduling
Slide 51: Web Application - Redundant Links
Web Application - Redundant Links Specify fully customizable patterns of redundant links so that the scan may not spend time crawling the similar links.
Slide 52: Web Application - Authentication
Web Application - Authentication Form Records • Standard Login • Custom • Selenium Script / Qualys Browser Recorder Server Records • Basic • Digest • NTLM
Slide 53: Manage Authentication Records
Manage Authentication Records The Authentication tab provides a convenient place for managing both Form and Server authentication records.
Slide 54: Exclusions
Exclusions White list - Crawl specific directories or pages (within application scope). - Content outside of ‘white-list’ is black-listed by default. - Target a specific area of modified/updated code. Black list - Prevent WAS from crawling sensitive or protected locations. Post Data Black List - Pre
Slide 55: Advanced Options - DNS Override
Advanced Options - DNS Override PRODUCTION 2 www.yourwebapp.com: 64.39.106.246 64.39.106.249 QUALYS CLOUD PLATFORM PRODUCTION 1 External Scanner Pool 64.39.106.246
Slide 56: DNS Override Settings
DNS Override Settings DNS Override: • Configure if DNS not yet configured for your app that’s currently in Dev or QA • Tag to manage assignment of DNS Override
Slide 57: Web Application - Form Training
Web Application - Form Training • This is a way for us to tell WAS what data to submit in a form, to follow a certain workflow. • Similar to how Qualys Recorder works. Works with just about any browser.
Slide 58: Web Application - Path Fuzzing
Web Application - Path Fuzzing Use case: For testing sites that use URL re-writing (asp.net MVC) Example: Let us consider sports web page http://www.abc.com/issue/17/section/sports/article/28 However, the web server will read this URL as http://www.abc.com/search.php?issue=17§ion=sports&article=
Slide 59: No Web Service
No Web Service The scan will give “No Web Service” status if the scanner: • Cannot get a DNS lookup on the site • Cannot reach the target because of routing • Cannot get a web service to respond to a GET request
Slide 60: API Testing
API Testing
Slide 61: APIs
APIs • Provide a way for machine-to-machine communication • Popular ones includes: • Representational State Transfer (REST) APIs • Simple Object Access Protocol (SOAP) APIs • APIs use HTTP and are vulnerable to many of the same attacks as web applications
Slide 62: Qualys Support for SOAP APIs
Qualys Support for SOAP APIs • Supports basic security testing of SOAP based web services that have a Web Service Description Language (WSDL) file within the scope of the scan • WAS uses the WSDL file to identify the web service methods and parameters supported • WAS will attempt to perform XSS and
Slide 63: Qualys Support for REST APIs
Qualys Support for REST APIs • RESTful web services can be exposed using files such as WADL (Web application description language), Swagger, or using proxy capture of the REST API client • Qualys WAS captures the REST requests via an uploaded proxy capture of the REST API client • Once the endpoints
Slide 64: Qualys Support for openAPI (REST)
Qualys Support for openAPI (REST) • Qualys WAS supports Swagger version 2.0 in JSON format • If the Swagger file is available and successfully parsed, the APIs will be automatically tested for security flaws
Slide 65: Qualys Support for openAPI (REST)
Qualys Support for openAPI (REST)
Slide 66: Swagger and non-Swagger based APIs
Swagger and non-Swagger based APIs
Slide 67: Lab 6, 7, 8 and 9
Lab 6, 7, 8 and 9 Please follow pages 15 – 21 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc2021-was 25 min. Lab 6 – Sitemap Lab 7 – Option Profile Lab 8 – QBR Script 1 Lab 9 – QBR Script 2
Slide 68: Reporting
Reporting
Slide 69: Dashboard
Dashboard Dashboard ‘Tue 08 Aug 2017 46 total scanned web apps “4 wth Malware Monitoring al al MOST VULNERABLE WEB APPLICATIONS View As Status Severity Submited == Finishes = ED Finishes = CED ‘AuVulnerabitties — TEI Severty TEI Seventy 1.23K 177 465 VewAl @) CATALOG View All Last Scan Date Total Vu
Slide 70: WAS Reporting
WAS Reporting • Results listed by vulnerability, link, type, app • Redundant results are condensed to a base cause • Create Templates to save report formats • Four report types • Schedule Reports to run when you need them
Slide 71: Web Application Report
Web Application Report • Normalized data of all scans on the web application • Choose tags or applications for report targets • Vulnerability Status included (New, Active, Re-opened, Fixed) • History of vulnerability • Retest for vulnerability
Slide 72: Scan Report
Scan Report • Raw Scan Results • Pick the specific scan results you’d like to view in a report • View Threat, Impact, and Solution for vulnerabilities
Slide 73: Scorecard Report
Scorecard Report • Statistics on all applications tagged in UI • Top 10 most vulnerable applications • OWASP breakdowns
Slide 74: Catalog Report
Catalog Report • Lists web apps as New, Approved, Rogue, or Ignored • Number of entries added over time • Number of entries by status
Slide 75: Report Management
Report Management • Create, download, run reports • Filter existing reports • Add tags to reports
Slide 76: QID 150021 – Scan Diagnostics
QID 150021 – Scan Diagnostics The scan diagnostics data provides technical details about the crawler's performance and behavior.
Slide 77: QID 150100 – Selenium Diagnostics
QID 150100 – Selenium Diagnostics Troubleshoot Selenium script See which parts of the script ran
Slide 78: Lab 10 and 11
Lab 10 and 11 Please follow page 22 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc2021-was 15 min. Lab 10 – Web App Report Lab 11 – Scan Report
Slide 79: Tags and Users
Tags and Users
Slide 80: Tag Management
Tag Management Add and remove tags to: • Users • Web Applications • Reports • Option Profiles • Brute Force Lists • Search Lists • Scanners • Parameter Sets • Authentication Records
Slide 81: User Roles
User Roles • User roles provide privileges to access tagged assets • Set granular permissions • Grant QA or Developers access
Slide 82: Customize a role
Customize a role \','7:\s) Web Application Scanning » WAS Asset Permissions (8 of 8) » Scanner Appliance Permissions (1 of 1) ¥ WAS Scan Permissions (3 of 3) © Launch WAS Scan Cancel WAS Scan Delete WAS Scan » WAS Schedule Permissions (3 of 3) » WAS Configuration Permissions (22 of 22) » WAS Catalog
Slide 83: Lab 12 and 13
Lab 12 and 13 Please follow pages 23 – 26 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc21-was 15 min. Direct Links: • Lab 12 – Tagging • Lab 13 – Users
Slide 84: Burp and Bugcrowd Integration
Burp and Bugcrowd Integration
Slide 85: WAS Integration
WAS Integration • Centralized location for vulnerability details.
Slide 86: Burp Suite Professional Integration
Burp Suite Professional Integration
Slide 87: Bugcrowd Integration
Bugcrowd Integration • Qualys WAS and Bugcrowd can now bi-directionally import and export findings
Slide 88: Web Malware Detection
Web Malware Detection
Slide 89: Malware Detection
Malware Detection 1. Enter URL 2. MDS does a breadth crawl URL You plug in your URL (we stay in the domain). 3. MDS runs both behavioral and static analysis. 4. Qualys will email user if Malware is found. Qualys Virtual Machine Farm
Slide 90: Malware Detection
Malware Detection Web Application Scanning v Dashboard WebApplications Scans Burp’ Reports Dashboard All Vulnerabilities I Severity Configuration KnowledgeBase Severity GW) Severity Malware SAFE BW bodgetiogin js Tags Fri 26 Sep 2014 645 94 243 308 O detections 24 total scanned web apps O with Malwa
Slide 91: Lab 14
Lab 14 Please follow page 27 from the Lab Tutorial Supplement Lab Supplement - https://bit.ly/qsc2021-was 5 min. Lab 14 – Burp Integration
Slide 92: Course Survey
Course Survey
Slide 93: Thank You
Thank You [email protected]