Building Custom Scanners for Web Security Research Automation
James Kettle, Director of Research at PortSwigger, outlines a strategic approach to developing custom automation tools for web security research. The article focuses on detecting under-appreciated attack classes, specifically web race conditions, by building on previous research regarding state machine vulnerabilities. Kettle advises researchers to avoid over-committing by automating only the smallest, earliest steps of manual testing, such as the probing phase, rather than attempting full automation immediately. He emphasizes embracing unexpected outcomes by avoiding rigid expectations in code, preferring false positives over false negatives to ensure no potential vulnerabilities are missed. The methodology involves using single-packet attacks to trigger anomalies and implementing iterative improvements within a Burp Suite extension. By automating the triage process to filter out irrelevant responses like timeouts and rate limits, researchers can efficiently identify promising findings, such as server-side request forgery or desync attacks. This approach aims to push the boundaries of web security by leveraging novel tooling and systematic automation to uncover subtle vulnerabilities in complex web applications.
Wire timeline
Building Custom Scanners for Web Security Research Automation
James Kettle, Director of Research at PortSwigger, outlines a strategic approach to developing custom automation tools for web security research. The article focuses on detecting under-appreciated attack classes, specifically web race conditions, by building on previous research regarding state machine vulnerabilities. Kettle advises researchers to avoid over-committing by automating only the smallest, earliest steps of manual testing, such as the probing phase, rather than attempting full automation immediately. He emphasizes embracing unexpected outcomes by avoiding rigid expectations in code, preferring false positives over false negatives to ensure no potential vulnerabilities are missed. The methodology involves using single-packet attacks to trigger anomalies and implementing iterative improvements within a Burp Suite extension. By automating the triage process to filter out irrelevant responses like timeouts and rate limits, researchers can efficiently identify promising findings, such as server-side request forgery or desync attacks. This approach aims to push the boundaries of web security by leveraging novel tooling and systematic automation to uncover subtle vulnerabilities in complex web applications.
PortSwigger Research