Companies are increasingly looking for ways to verify the security of their applications with minimal effort. Our SecurityXperts quickly came across testing tools developed in Python. As a high-level programming language, Python allows developers to write programs that are quickly ready for use and can be integrated relatively easily into existing infrastructures. This has led to a veritable explosion of platform-independent support tools built with Python in recent years.
To keep complexity to a minimum, the open-source applications we’ll be examining in this post follow the tried-and-true KISS principle (keep it simple and stupid). This simplicity means that the programs can be easily integrated into existing pipelines or replaced with other solutions. With the help of pip, the Python package manager, makes it quite easy to install the tools.
Checking Transport Encryption with SSLyze
The open-source program SSLyze allows you to get a good overall picture of a web server's transport encryption. A look at the help page with sslyze -help provides an overview of the supported commands. For example, if you want to run a scan on a domain, simply pass the domain as an argument to SSLyze.
Example:
sslyze [Domain]
- In the first step, we receive information about the certificate chain used and its validity periods.
- Next, connections are established sequentially using the SSL and TLS versions to be tested, and the results are displayed in the terminal.
- In the final step, the cipher suites are selected according to the currently valid recommendations of the Mozilla Foundation and analyzed with recommendations for action.
In addition, SSLyze includes a test for common attacks targeting misconfigured web servers. A full scan with SSLyze takes only a few seconds.
To significantly reduce the log output for the run in a pipeline, additional arguments can be passed to SSLyze. With --mozilla_config=intermediate (or "modern" or "old") can be tested, for example, for strong encryption with good backward compatibility with older browsers. In this case, the output consists solely of the violations of the specified backward compatibility policy.
More information: https://github.com/nabla-c0d3/sslyze
Testing for SQL Injections with sqlmap
SQL injection is another point of entry for unauthorized actors.
But what exactly is an SQL injection?
If an input field is not properly validated before its contents are forwarded to the server, this may, under certain circumstances, lead to unintended injections of external code. An SQL injection, therefore, involves the execution of unintended SQL code. This can result not only in data theft but also in the complete remote deletion of that data. To prevent this, input fields must be regularly checked to ensure they are properly validated.
One option for this is the „sqlmap“ tool. It can be used for an initial scan in interactive mode via sqlmap --wizard be opened. In this mode, the required data is retrieved sequentially, followed by a scan. For use in a pipeline, we recommend passing the required parameters from the scan’s help page as arguments. Additionally, you should not run the scan with every single build, as it may take a very long time under certain circumstances.
More information: https://github.com/sqlmapproject/sqlmap
Testing OS Command Injections with Commix
Commix is a tool that works similarly to sqlmap. Commix performs a series of tests aimed at injecting code into the host operating system to gain direct access at the system level. Due to the many possible entry points, a scan can take up to several hours. Additionally, the network should not be overloaded during this time, as Commix also attempts timing-based attacks.
Precisely because this is a test of the actual application of the underlying infrastructure, it is not necessary to run it with every build. We therefore recommend integrating it into a pipeline separate from the build process. Commix also offers a wide range of parameters for this purpose, which can be configured using commix --help allow access to.
More information: https://github.com/commixproject/commix
Vulnerability scan using Wapiti
Unlike the tools presented earlier, which focus on specific security vulnerabilities, Wapiti stands out for its ability to detect a wide range of security issues. The list of identified vulnerabilities is available on the official website: https://github.com/wapiti-scanner/wapiti.
Wapiti also includes the SSLyze scan, which underscores its versatility. With a simple command like wapiti -u [URL] A quick scan can be performed, and the tool then generates a detailed HTML report with the results.
More information: https://github.com/wapiti-scanner/wapiti
Conclusion
Gaining a security overview of your own software project doesn’t have to be complicated. On the contrary—even with minimal resources, you can gain important insights that efficiently uncover potentially costly security issues. To ensure that this overview isn’t just a snapshot but is maintained continuously, integrating it into the project’s pipelines is a good approach.
All of the tools presented here are black-box scanners and therefore do not have access to the target's source code. In addition to these applications, solutions should also be used to scan the source code for programming errors and the libraries used for known security vulnerabilities (CVE).
The overview compiled by our Xperts represents only a selection and is therefore by no means exhaustive. Programs such as smbmap and DNSRecon can further refine their perspective on their own infrastructure.
As technological advances increase the potential for attacks, it is important to stay up to date. Our Xperts are already working on another article about security tools that go beyond Python.
