7 ms·

He's also the author of Skipfish (a fairly new web scanner), which I've been making a lot of use of the past few months. It's still fairly beta, but already I

He's also the author of Skipfish (a fairly new web scanner), which I've been making a lot of use of the past few months. It's still fairly beta, but already I find it to be more useful than WebInspect in many cases.

tptacek 16y ago
That's a pretty horrible indictment of WebInspect, because Skipfish virtually never finds anything for us (we ban scanners on our teams, but I like Zalewski and tend to run Skipfish just for kicks).
- m0nastic 16y ago
  I suppose it's somewhat of a backhanded compliment. I honestly wouldn't pay money for the results I get from WebInspect (we have licenses for it, so we use it). I swear that WebInspect has gotten noticeably worse the past year and a half or so. Prior to that, it would at least occasionally find something interesting; but I honestly can't remember the last time it found something that wasn't a false positive. As to SkipFish, I would say that the past three applications I've run it against it's found at least one interesting thing (which is high praise for automated tools in our industry).
- viraptor 16y ago
  Any specific reasons you don't use them? It's a pretty interesting view from a security guy really... most of those I heard before say something like "it doesn't hurt to leave it running, while we do our stuff manually - sometimes it works". Also, did you mean fuzzers in general or only web scanners?
  - tptacek 16y ago
    Just scanners. Everyone uses Burp's fuzzer. And in the rare cases we end up doing network pentests, we will use Nessus. Scanners make testers stupider. Even if you are conscientious about using them responsibly†, they still work to turn off the part of your brain that thinks about the kinds of flaws they do a good job of detecting. If you say you'll only run them at the end of a engagement to see if there's anything you missed, now you're working with a safety net. † And we've worked on plenty of projects that had previous runs from teams that weren't responsible about scanners, with predictably horrific results.
    - m0nastic 16y ago
      We recently partnered with another assessment firm to handle overflow (something not one person in our group was happy about, but we spent the entirety of 2010 overworked), and in the past couple weeks I've had two issues come to me where this firm submitted a clean report with no findings. They asked me to take a quick look at the applications (as it's a somewhat rare occurrence to not have a single finding), and I immediately turned up a bunch of issues. Upon further inspection, this company is just running WebInspect, without apparently any actual validation or manual testing. I so need to get out of our industry.
      - tptacek 16y ago
        Or move to a better company. I tried running away from security in 1998 and found that there's charlatanism anywhere you go. Try being a baker; no, wait, there are well-marketed charlatan bakers, too! There is at least one other company that has publicly banned web scanners. My take is, you should work for/retain companies that refuse to use scanners, and, when possible, avoid using companies that mention using them. A friend of mine, who I'd have loved to work with, ended up at a security company whose sales pitch to him included "we buy our consultants whatever tools they want, so you can have WebInspect and AppScan". I was unable to convince him that this was a "run, don't walk" red flag. Don't get me started on paid overtime.
        m0nastic 16y ago
        Or move to a better company. I tried running away from security in 1998 and found that there's charlatanism anywhere you go. Try being a baker; no, wait, there are well-marketed charlatan bakers, too! I figure it's a new year and maybe I'll finally man up and find someplace more fulfilling. My issue is that the pattern I find tends to be: 1. Go work with a bunch of really smart, awesome folks doing cool work. 2. Group is successful, gets bought by large monolith. 3. It gets shitty, everyone leaves, starts over somewhere new. 4. Repeat steps 1-3 I am literally on the fourth iteration of this process. A friend of mine, who I'd have loved to work with, ended up at a security company whose sales pitch to him included "we buy our consultants whatever tools they want, so you can have WebInspect and AppScan". I was unable to convince him that this was a "run, don't walk" red flag. That's a bit like liking both "country" and "western". Don't get me started on paid overtime. In general I've never complained too much about hours. I've always found that this type of work is cyclical as far as how busy you are on any particular test. As long as I can remember, it always went that 4th quarter was crunch time (with companies having to spend their budget before the end of the year) so you'd have to bust your ass for a few months, but then things would lull a bit in January (as budgets aren't allocated yet). For some reason, this past year the entire year was like that 4th quarter sprint.

tptacek 16y ago

That's a pretty horrible indictment of WebInspect, because Skipfish virtually never finds anything for us (we ban scanners on our teams, but I like Zalewski and tend to run Skipfish just for kicks).

m0nastic 16y ago
I suppose it's somewhat of a backhanded compliment. I honestly wouldn't pay money for the results I get from WebInspect (we have licenses for it, so we use it). I swear that WebInspect has gotten noticeably worse the past year and a half or so. Prior to that, it would at least occasionally find something interesting; but I honestly can't remember the last time it found something that wasn't a false positive. As to SkipFish, I would say that the past three applications I've run it against it's found at least one interesting thing (which is high praise for automated tools in our industry).
viraptor 16y ago
Any specific reasons you don't use them? It's a pretty interesting view from a security guy really... most of those I heard before say something like "it doesn't hurt to leave it running, while we do our stuff manually - sometimes it works". Also, did you mean fuzzers in general or only web scanners?
- tptacek 16y ago
  Just scanners. Everyone uses Burp's fuzzer. And in the rare cases we end up doing network pentests, we will use Nessus. Scanners make testers stupider. Even if you are conscientious about using them responsibly†, they still work to turn off the part of your brain that thinks about the kinds of flaws they do a good job of detecting. If you say you'll only run them at the end of a engagement to see if there's anything you missed, now you're working with a safety net. † And we've worked on plenty of projects that had previous runs from teams that weren't responsible about scanners, with predictably horrific results.
  - m0nastic 16y ago
    We recently partnered with another assessment firm to handle overflow (something not one person in our group was happy about, but we spent the entirety of 2010 overworked), and in the past couple weeks I've had two issues come to me where this firm submitted a clean report with no findings. They asked me to take a quick look at the applications (as it's a somewhat rare occurrence to not have a single finding), and I immediately turned up a bunch of issues. Upon further inspection, this company is just running WebInspect, without apparently any actual validation or manual testing. I so need to get out of our industry.
    - tptacek 16y ago
      Or move to a better company. I tried running away from security in 1998 and found that there's charlatanism anywhere you go. Try being a baker; no, wait, there are well-marketed charlatan bakers, too! There is at least one other company that has publicly banned web scanners. My take is, you should work for/retain companies that refuse to use scanners, and, when possible, avoid using companies that mention using them. A friend of mine, who I'd have loved to work with, ended up at a security company whose sales pitch to him included "we buy our consultants whatever tools they want, so you can have WebInspect and AppScan". I was unable to convince him that this was a "run, don't walk" red flag. Don't get me started on paid overtime.
      - m0nastic 16y ago
        Or move to a better company. I tried running away from security in 1998 and found that there's charlatanism anywhere you go. Try being a baker; no, wait, there are well-marketed charlatan bakers, too! I figure it's a new year and maybe I'll finally man up and find someplace more fulfilling. My issue is that the pattern I find tends to be: 1. Go work with a bunch of really smart, awesome folks doing cool work. 2. Group is successful, gets bought by large monolith. 3. It gets shitty, everyone leaves, starts over somewhere new. 4. Repeat steps 1-3 I am literally on the fourth iteration of this process. A friend of mine, who I'd have loved to work with, ended up at a security company whose sales pitch to him included "we buy our consultants whatever tools they want, so you can have WebInspect and AppScan". I was unable to convince him that this was a "run, don't walk" red flag. That's a bit like liking both "country" and "western". Don't get me started on paid overtime. In general I've never complained too much about hours. I've always found that this type of work is cyclical as far as how busy you are on any particular test. As long as I can remember, it always went that 4th quarter was crunch time (with companies having to spend their budget before the end of the year) so you'd have to bust your ass for a few months, but then things would lull a bit in January (as budgets aren't allocated yet). For some reason, this past year the entire year was like that 4th quarter sprint.