\n
Introduction:
\n
In this OWASP Automated Threat Article we'll be highlighting OAT-014 Vulnerability Scanning with some basic threat information as well as a recorded demo to dive into the concepts deeper. In our demo we'll show how Vulnerability Scanning can be a threat to your applications and how to quickly offer protection from these automated scanners. We'll wrap it up by highlighting F5 Bot Defense to show how we solve this problem for our customers.
\n
Description:
\n
\n
\n
\n
\n
Systematic enumeration and examination of identifiable, guessable and unknown content locations, paths, file names, parameters, in order to find weaknesses and points where a security vulnerability might exist. Vulnerability Scanning includes both malicious scanning and friendly scanning by an authorised vulnerability scanning engine. It differs from OAT-011 Scraping in that its aim is to identify potential vulnerabilities.
\n
\n
\n
\n
\n
OWASP Automated Threat (OAT) Identity Number
\n
OAT-014
\n
Threat Event Name
\n
Vulnerability Scanning
\n
Summary Defining Characteristics
\n
\n
\n
\n
\n
Crawl and fuzz application to identify weaknesses and possible vulnerabilities.
\n
\n
\n
\n
\n
OAT-015 Attack Demographics:
\n
\n\n\n| Sectors Targeted | \nParties Affected | \nData Commonly Misused | \nOther Names and Examples | \nPossible Symptoms | \n
\n\n| Entertainment | \nApplication Owner | \nOther Business Data | \nActive/Passive Scanning | \n\n\n \n \n \n Highly Elevated Occurrence of Errors \n \n \n \n | \n
\n\n| Financial | \n | \nPublic Information | \nKnown Vulnerability Scanning | \n\n\n \n \n \n Extremely high application usage from a single IP address \n \n \n \n | \n
\n\n| Government | \n | \n | \nMalicious Crawling | \n\n\n \n \n \n Exotic value for HTTP user agent header \n \n \n \n | \n
\n\n| Retail | \n | \n | \nVulnerability Reconnaissance | \nDisproportionate use of the payment step | \n
\n\n| Technology | \n | \n | \n | \nHigh ratio of GET/POST to HEAD requests for a user | \n
\n\n| Social Networking | \n | \n | \n | \nLow ratio of static to dynamic content requests for a user/session/IP address compared to typical users | \n
\n\n| Education | \n | \n | \n | \n | \n
\n\n
\n
\n
Protecting your Applications from Vulnerability Scanning:
\n
In this demo we will be showing how attackers leverage scanning tools to search for vulnerabilities. We'll then have a look at the same attack with F5 Distributed Cloud protecting the application.
\n
\n
\n
In Conclusion:
\n
Vulnerability scanning occurs across the internet constantly to all exposed surfaces from many locations, regions and systems. Some of these have good intentions, some do not. Our goal is to limit exposure and to minimize risk. By blocking bad bots and only allowing good bots you are protecting your applications from threat actors possibly finding a vulnerability and switching to a manual attack phase of your web applications.
\n
OWASP Links
\n
\n
F5 Related Content
\n
\n
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
©2024 F5, Inc. All rights reserved. 