That seems pretty simple, but thats a lot of attack types to map to some logic, so for now I will leave it generic.
The next step is to get a vulnerability scan of a vulnerable web application. I wont go into how to use Nessus here, but one of the export options is a ".nessus" which is just an XML file. There is actually too much data in this file, but you can leave it as is. If you want to read it you can remove the <Policy> sections because all we want are the Reports. For this test, I ran a scan against google-gruyere.appspot.com, which is an unsecured app available to the internet. Dont do this from AWS or someone will come looking for you, ask me how I know...
Example of results:
<?xml version="1.0" ?>
<Report name="ASMv2" xmlns:cm="http://www.nessus.org/cm">
<tag name="HOST_END">Tue Aug 29 14:08:04 2017</tag>
<tag name="policy-used">Advanced Scan</tag>
<tag name="operating-system">Linux Kernel 2.2
Linux Kernel 2.4
Linux Kernel 2.6</tag>
<tag name="HOST_START">Tue Aug 29 13:21:20 2017</tag>
<ReportItem pluginFamily="CGI abuses" pluginID="39470" pluginName="CGI Generic Tests Timeout" port="443" protocol="tcp" severity="0" svc_name="www">
<description>Some generic CGI tests ran out of time during the scan. The results may be incomplete.</description>
<plugin_name>CGI Generic Tests Timeout</plugin_name>
<script_version>$Revision: 1.13 $</script_version>
<solution>Consider increasing the 'maximum run time (minutes)' preference for the 'Web Applications Settings' in order to prevent the CGI scanning from timing out. Less ambitious
options could also be used, such as :
- Test more that one parameter at a time per form :
'Test all combinations of parameters' is much slower than 'Test random pairs of parameters' or 'Test all pairs of parameters (slow)'.
- 'Stop after one flaw is found per web server (fastest)' under 'Do not stop after the first flaw is found per web page' is quicker than 'Look for all flaws (slowest)'.
- In the Settings/Advanced menu, try reducing the value for 'Max number of concurrent TCP sessions per host' or 'Max simultaneous checks per host'.</solution>
<synopsis>Some generic CGI attacks ran out of time.</synopsis>
<plugin_output>The following tests timed out without finding any flaw :
- XSS (on HTTP headers)
- blind SQL injection
- local file inclusion
- blind SQL injection (time based)
- unseen parameters
- directory traversal (extended test)
- directory traversal
- arbitrary command execution
- SQL injection (on HTTP headers)
- SQL injection
So far so good... Some of this will be a mess, but we can take a stab at it...
So lets mash it all together!
So how to tie it all together? There are some tools to help, online, I used to have on for Windows but I dont remember what its called, but I have a MAC now, so...