SUPPORT

Contact Support

OPEN A TICKET

How Netsparker Shark enriches vulnerability reports

Netsparker helps to streamline remediation efforts by providing detailed information about issues even down the line of code and instructions on how to fix each issue.

Netsparker is a dynamic application security testing tool (DAST). It probes the entire running application, so it can test the entire attack surface and find all the vulnerabilities that an attacker could. Even so, it still has no access to the source code, so it cannot truly pinpoint identified weaknesses.

  • When you install and use the Shark sensor, Netsparker becomes an IAST solution (grey-box scanner) in addition to being a DAST scanner (black-box scanner).
  • The Shark sensor works together with the main vulnerability scanning engine to extend the DAST capabilities of the Netsparker vulnerability scanning engine.
  • Shark sensors continuously provide additional information about vulnerabilities and the environment itself.

With Shark sensors, Netsparker can pinpoint many vulnerabilities right down to the line number and provides additional details for security teams.

The following table shows how the combination (DAST+IAST) enriches the issue result:

Name

Severity

Extra Information

SQL Injection

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Boolean Based SQL Injection

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Blind SQL Injection

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload        

Command Injection

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Blind Command Injection

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Code Evaluation (PHP)

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Code Evaluation (ASP)

Critical

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Local File Inclusion

High

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

HTTP Header Injection

Medium

  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

While Shark sensors extend the capabilities of Netsparker's main vulnerability engine, it also runs its own attacks to identify other vulnerabilities.

IAST attacks in Netsparker are enabled by default. If you want to scan your application with a customized scan policy, make sure you included IAST attacks into the custom scan policy. So, Netsparker Shark can run its own attacks as well. If not included, Netsparker Shark falls back to enriching existing engines.

The following list shows the vulnerabilities Shark sensors can identify:

Name

Severity

Extra Information

SQL Injection (IAST)

Critical

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Command Injection (IAST)

Critical

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Code Evaluation PHP (IAST)

Critical

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Local File Inclusion (IAST)

High

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Arbitrary File Creation Detected

High

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

Arbitrary File Deletion Detected

High

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

HTTP Header Injection (IAST)

Medium

  • New Vulnerability Template
  • Source file
  • Line number
  • The function that has been called with the payload
  • Payload

PHP enable_dl Is Enabled

Medium

Netsparker provides a brand new template specific for this vulnerability

PHP register_globals Is Enabled

Medium

Netsparker provides a brand new template specific for this vulnerability

PHP session.use_trans_sid Is Enabled

Medium

Netsparker provides a brand new template specific for this vulnerability

PHP allow_url_fopen Is Enabled

Low

Netsparker provides a brand new template specific for this vulnerability

PHP allow_url_include Is Enabled

Low

Netsparker provides a brand new template specific for this vulnerability

PHP display_errors Is Enabled

Low

Netsparker provides a brand new template specific for this vulnerability

PHP open_basedir Is Not Configured

Low

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Tracing Is Enabled

High

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Cookieless Authentication Is Enabled

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Cookieless Session State Is Enabled

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Custom Errors Is Disabled

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Login Credentials Stored In Plain Text

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET ValidateRequest Is Globally Disabled

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET: Failure To Require SSL

For Authentication Cookies

Medium

Netsparker provides a brand new template specific for this vulnerability

ASP.NET ViewStateUserKey Is Not Set

Low

Netsparker provides a brand new template specific for this vulnerability

ASP.NET Debugging Enabled

Information

Netsparker provides a brand new template specific for this vulnerability

Hidden Files (IAST)

Netsparker gets all hidden files within the application. From there, Netsparker adds these files to the link pool so that Netsparker can crawl and attack them.

For further information, watch this video:

 

Netsparker

Highly accurate, fast & easy-to-use Web Application Security Scanner

Get a demo