Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security

OWASP's VulnXML Database 68

Posted by michael from the autocracker dept.
Ingo Struck writes "The Open Web Application Security Project released the VulnXML db for early access to the public. VulnXML is a description of static known vulnerabilities. It provides all necessary information to let an execution engine automatically craft and launch appropriate HTTP, SOAP or WebDAV requests and analyse the response whether the attack had success. Besides it provides some human readable classification of the described vulnerability. A tool to execute VulnXML records is currently being developed and will help developers to check their web applications against a suite of well-known vulnerabilities described in a portable format."
This discussion has been archived. No new comments can be posted.

OWASP's VulnXML Database More

OWASP's VulnXML Database

Comments Filter:

  • Double-edged Sword? (Score:4, Interesting)

    by melete ( 640855 ) on Saturday July 05, 2003 @04:12PM (#6373657)
    As always, it sounds like this is a double egded sword -- won't this give script-kiddies a new engine for quickly scanning for possibly vulnerable targets?

    Not that I'm saying this is a bad thing -- it's just one more tools that security professionals will have to use to stay ahead of the competition.

    • Sysadmins? (Score:5, Interesting)

      by SHEENmaster ( 581283 ) <travis&utk,edu> on Saturday July 05, 2003 @04:23PM (#6373688) Homepage Journal
      This could also be used to create a "Super" Nessus. Remember that script kiddies and system administrators both use such tools. I think that in the long run, it will help the latter more.
      • Well, this isn't going to be a "super nessus" really. It still requires that some human being write the initial signature (XML encoding of the vuln/exploit). While it may provide an easier framework for creating those signatures than Nessus' NASL language (and that hasn't yet been proven), the core technology doesn't advance the state of attacker tools enough to really be that dangerous.

        The only thing to fear (potentially) is that all those signatures are getting written now! And I'll agree with SHEENm

    • Re:Double-edged Sword? (Score:3, Insightful)

      by PaulK ( 85154 )
      This doesn't seem as bad as that...

      Scanning scripts exist everywhere, but this isn't one of them. This is a repository for known vulnerabilities, which will serve admins far more than kiddies.

      I can quickly check the db for issues on any proposed software, etc....

      This is not another virlab [kklotz.de].

      • Re:Double-edged Sword? (Score:5, Informative)

        by PaulK ( 85154 ) on Saturday July 05, 2003 @04:35PM (#6373723)
        Hmmmm.....

        I suppose I'll have to throw myself on my own sword.

        After digging through the "whisper" entries, it looks as if that is ALL it is... a repository for scripts. [owasp.org]

        My apologies. I did read the overview, but it doesn't coincide with the actual database.

        This is disturbing.

        • Re:Double-edged Sword? (Score:2, Informative)

          by istr ( 686577 )
          Sorry for that...
          :o|
          The db is beta. That means, all entries found there are only for demonstration purposes. Most are imported from some very outdated Whisker set.
          Currently the objective of that db is to evaluate the viability of the entry editor and the data format, not to provide some up-to-date real checks.
          I updated the welcome text appropriately.
          Thanks for the hint.
          • Thanks for the supplemental info. It's good to know that my initial perception [slashdot.org] was closer to the mark.

            I'm also grateful that you saw my comment as constructive criticism rather than a flame.

            Neither was intended, it was meant merely as an observation; even so, kudos for separating the wheat from the chaff.

    • You're right, this will help script-kiddies attack computers of the non-security conscious more easily, I suppose.

      However, if you care at all about security, it's also going to make it really easy for you to fix any possible problems. Consider the situation as it is now: You protect yourself against all vulnerabilities you know about, and suffer the chances of a cracker finding out that you have a vulnerability in something that you weren't informed of.

      Now consider having a central database with all k

    • You'd rather have security through obscurity??

    • Re:Double-edged Sword? (Score:2, Insightful)

      by dimmu ( 214039 ) *
      There is no real cure to make tools only available to system administrators and not to script-kiddies. One way that would work is making it very difficult to use, but there will be obviously a nicer frontend for such a tool within weeks (if not days).

      I must confess that one of the advantages of closed source is that a vendor could integrate a security measure that would bind a certain serialcode or flexlm key to a certain pool of machines that may be checked by such a tool. This would also slow down script
    • Oh, yeah, the terrorists could use this, couldn't they? Call out the Patriot Act!

  • All right! (Score:5, Funny)

    by Fly Ricky - The Wine ( 590782 ) on Saturday July 05, 2003 @04:12PM (#6373659)
    Just in time for July 6th!

  • Wow (Score:4, Funny)

    by Saint Aardvark ( 159009 ) * on Saturday July 05, 2003 @04:13PM (#6373663) Homepage Journal
    A tool to execute VulnXML records is currently being developed

    Now that's security by obscurity! <rimshot />

    Thank you, ladies and germs, I'll be here all week.

  • well... (Score:5, Insightful)

    by LittleBigLui ( 304739 ) on Saturday July 05, 2003 @04:14PM (#6373667) Homepage Journal
    It provides all necessary information to let an execution engine automatically craft and launch appropriate HTTP, SOAP or WebDAV requests and analyse the response whether the attack had success.


    so we've just replaced script kiddies with a (very small) shell script?

    • Re:well... (Score:3, Funny)

      by Anonymous Coward
      Why not, we've already replaced advanced virus delivery systems with stupid users who would even be willing to open sexy-fun-i-am-not-a-virus-honest.exe
    • Apparantly so.

      As a matter of fact, I found no data about fixes/patches whatsoever, or even what the vulnerabilities are. Just a damn script for exploit.

      The site is junk; stuff broken everywhere, and pointed to the wrong pages.

  • Binary XML (Score:1, Offtopic)

    by csbruce ( 39509 )
    Check out BXML [opengis.org] for a binary encoding of XML to efficiently carry scientific/array-type data. Feedback appreciated.
    • Check out BXML for a binary encoding of XML to efficiently carry scientific/array-type data. Feedback appreciated.

      Why not just ZIP, RAR, or otherwise compress the file? Does there need to be a separate standard?

      • Why not just ZIP, RAR, or otherwise compress the file? Does there need to be a separate standard?

        Because processing reams of text-delimited markups and arrays of text-encoded numbers or blobs is sloooooow. It's not about compression, but you can GZIP/whatever either text or binary.

        For scientific data in XML, the process is to take an array of numbers, convert the numbers to text (expensive), compress the numbers (which is slow, especially because of the bulk of the numbers), transport, uncompress, and r
  • I know security is the first thing that leaps to my mind when I read that name. ;)
  • I've used Nessus to scan mine own boxen for months now. Very useful and powerful. Having this shouldn't raise any warning flags, being that a similar tool for this has been around for a long time now.

    By the by, turn off stuff you don't need and you'll find most vulnerabilities disappear like magic.

    Also, remember to scan your machines from private and public access just in case.

  • Yet another.. why? (Score:4, Insightful)

    by Knightmare ( 12112 ) on Saturday July 05, 2003 @05:04PM (#6373845) Homepage
    I honestly don't see the purpose in this site or the tool being developed to use it. I use Nessus on a daily basis and it seems to work just fine for this task.

    I mean what more could you ask for... a client/server based vuln. scanner that will give you reports in xml, csv, txt, html, doc... Since the site and database has been created, maybe you should just write a program that exports the exploit tests as Nessus nasl scripts [nessus.org] so we can do the tests and Snort rules [snort.org] so we can detect testing.
  • So this could become an open XML database of all known attacks and vulnerabilities? I think that's fantastic - not because I like to break into systems, but because it could be a real stick in the eye of all those expensive, proprietary security tools... and I love opportunities to poke sticks in the eyes of the establishment.

    It's a very simple idea, but I've never seen anything like it in an open website. Is this new only because it's not a black hat operation?

  • I think most people are missing this (Score:3, Informative)

    by Michael Crutcher ( 631990 ) on Saturday July 05, 2003 @05:18PM (#6373896)

    From the site:
    This database is intended to enable the maintenance of a peer group based set of XML descriptions for web application attacks.

    Most people here are comparing this to vulnerability scanners like nessus, but acording to the description provided by the website this appears to be something entirely different. It doesn't check for known vulnerabilities versus services, but rather tries various attacks on web applications. I'm sure that something out there has been created along these same lines before, but I've never heard of it. This sounds like a good idea, and an easy way for inexperienced web application designers to insure that they're not vulnerable to a large database of known attacks.

    Sounds pretty cool to me.

  • Just in time for tomorrow! (Score:3, Informative)

    by bc90021 ( 43730 ) <bc90021&bc90021,net> on Saturday July 05, 2003 @05:21PM (#6373920) Homepage
    ...since tomorrow is apparently Defacement Day [com.com].

  • MITRE's OVAL and OpenSec (Score:2, Interesting)

    by Anonymous Coward

    For those interested in open standards for vulnerability assessment, you should check out the Open Vulnerability Assessment Language (OVAL - http://oval.mitre.org/ [mitre.org]). OVAL provides assessments that DO NOT PERFORM THE ACTUAL EXPLOIT but rather specify logical conditions on the values of system characteristics and configuration attributes to characterize which systems are susceptible to a given vulnerability.

    The assessments use SQL syntax but there is an XML version coming soon.

    The Open Security Project

    • I'm actually working on OVAL. The first critical difference to understand is that OVAL covers all vulnerabilities, while VulnXML only covers web-based vulns.

      BTW, all the software described below either is or will be free.

      Now, OVAL is in SQL right now, but we're working on an XML translation mechanism. The SQL is nice because it's intensely readable and writable by humans and also because it can be used to query a database of system attributes. That database leads to a technology called QNA, formerly

  • If people would stick to the relational model, then XML would not be of much use above what a slightly improved comma-delimited format could provide.

    I know, some of you don't feel that highly about relational and prefer the older "navigational" formats, but I think relational offers more consistent and logical organization rules and has a better "algebra" to go with it. It is harder to make cross-reference, normalization, and referential integrity rules with structures like XML (except under rare circumsta
    • Indeed. XML is quite oversold. I could understand the need for human-parseable data files, but XML sucks for a data storage and transmission mechanism. See: this thread [slashdot.org] for an example of the lunacy of XML.

    • Re:XML oversold IMO (Score:2, Interesting)

      by istr ( 686577 )
      I agree to a certain extent.
      In fact XML is just a serialization format. Alas a format with lots of unnecessary overhead. :o(
      The decision for using XML maybe was based upon it's "popularity" - I don't remember...
      Fortunately the serialization format can be switched within seconds to something less overheaded (since we use the OCL [owasp.org] with a generic serialization mechanism). So it is very easy to provide the good ol' properties format instantaneously.
      IMO For VulnXML's duty some relational format is clearly ove
  • That is very interesting. .

  • A GPL VulnXML engine (Score:2, Informative)

    by daveaitel ( 598781 )
    Immunity's SPIKE Proxy (http://www.immunitysec.com/spike.html) offers a python, GPL, VulnXML engine, and has for some time. VulnXML is superior to Nessus-style scripting in many ways for purely web-based assessments. Similar to how Nessus says "for all ports that have a web server on them, run these tests" VulnXML allows a fully interoperable and "self-descriptive" way to say "For all files on the web server, check for file.bak, but ignore custom 404 pages that return 200 OK, etc".
  • 1. take VulnXML db
    2. convert to OpenSTA script
    3. run OpenSTA

  • Wouldn't a machine-readable vulnerability database allow for a worm that could keep up to date with the latest vulnerabilities by itself?

Slashdot Top Deals

Put your Nose to the Grindstone! -- Amalgamated Plastic Surgeons and Toolmakers, Ltd.

Close