Automated Application Security Testing with StackHawk

Hey, Node Congress, Scott Gerlach, Chief Security Officer and co-founder here at StackHawk. I hope you're having a great conference, learning lots about Node. Let's talk about StackHawk. Quickly, StackHawk is a dynamic application security testing tool. You can use it to test your running HTTP applications and API endpoints for security bugs and keep them from becoming vulnerable. You can use StackHawk to run active security tests on your running REST API, GraphQL API, SOAP API, server-side application and single page applications.

StackHawk was built for automation in CI-CD to be part of your robust testing strategy for your application development lifecycle. It also makes finding, understanding, and fixing security bugs easy. How does StackHawk work, you ask? Great question! StackHawk runs active security tests against your running applications to ensure that your application is handling user input and output in a safe manner, as well as implementing OWASP top 10 best practices for application security. We can do this against your running application on your local host, in CI-CD workflows, and against applications that have yet to be published on the internet. We also made dynamic testing fast. By placing the scanner as close to the application as possible and by using open standards to inform the scanner, open API spec, GraphQL, introspection queries, SOAP, WSDL, in addition to the scanner tuning we've made, most StackHawk customer applications scan average around or under 10 minutes.

Finding and fixing security issues is simple with StackHawk. Our focus as a company is to help developers find and most importantly fix security issues. The StackHawk scanner and platform are built around this simplicity model. The scanner is configured via YAML that lives with the code for the application that you're testing. When StackHawk findings are triaged, the platform is trying to give you the simplest version of the information needed to help you quickly understand what the problem is with simple descriptions and example patterns to help you identify the anti-pattern, be able to recreate the issue with tools like simple cURL command to replay the attack, and get you into debug mode stepping through code as fast as possible to help you fix issues and get back to your regular job of creating value for your customers. All of this is CICD enabled. Again, you can integrate this into your CI process and importantly, get feedback into the CI process on scan findings. This information can be used to break a build if you choose, based on severity of un-triage findings. Most of the major CI player logos are shown here on this slide and even if your particular one isn't, chances are pretty good StackHawk will work in your platform as long as it can run a Docker container. If you can run Docker, you can run StackHawk. You can also see here StackHawk integrates with your workflow and information tools. We can notify you of your scan results in a Slack channel, publish that information to Data Dog, or send you a simple webhook message that you can then use to process and do with the data what you choose.

Let's take a look at what running the StackHawk scanner looks like. As you can see here, I've got a standard server-side application. This one is a polls app that I want to test for security issues. So over here on my command line, I've got a simple Docker command that I ran. So, docker run stackhawk. I fed it the stackhawk YAML, we'll look at that in a second.

As you can see, it did a standard crawl looking for all the interesting things on the webpage that it could, and then it did an attack. So it actively attacked this application for potential security issues. When it was all done, we've got a summary of these findings.

So I've actually got a SQL ejection issue that I need to take care of, you can see that it's new. I also have a cross-site scripting issue that I've done something with before. I actually made a ticket out of this. So now it's in an assigned status. We've got a bunch of other things that we can look at as well, but let's take a look at those, too.

Down here at the bottom, we actually have a link to this scan, so we can actually take this link and paste it into a browser. By the way, output in a CICD system would look very much like this, because this is the standard output. So if you did choose to break a build, you would have this same link in CICD output. So we can go over here to our web browser and jump right into the scan that we're looking at. We were just looking at this exact same scan.

We've got this SQL injection issue that we can look at quickly. You can see that we've got a SQL injection issue. We're quickly describing what SQL injection is, how to remediate it, what it's about, and what risks it might pose to an application. We also have links to different language frameworks that show you the pattern of how to prevent SQL injection in Spring, Laravel, Django, and Rails so that you can help identify the anti-pattern that we're looking for. Let's take a look at this particular issue here.

So we can see that on the PULS SQL path, we have a POST method that has some kind of an issue. Over on our right-hand panel, we've got a request and response of what the scanner actually did and then came back with. So we can see that the scanner made a request here against the application and it responded in some form or fashion. We can actually see that the scanner made a case-when injection here. So we could replay this if we wanted to. This is all helping you understand what the scanner is trying to do and what issue it thinks it's found. But interestingly, we've got this really cool VALIDATE button up here.

As I mentioned before, this VALIDATE button gives you a curl command of exactly what the scanner did to identify this particular issue. So you can copy and replay this attack against an application. Let's take a look at that StackHawk YAML. Here you can see the code that I've used to build my polls application. Inside of this repository I've also stored the StackHawk YAML.

The StackHawk YAML is how you configure the StackHawk scanner. So you can see the important information that's in here is, where do I find the application I need to test? In this case, it's running on my local machine, so localhost 8020. What environment am I in and what is the application ID? That is the minimal amount of information you need to run a StackHawk scan against your application. There are other pieces of information that help tune the scanner to your application, such as authentication, how to handle cookies and CSRF tokens, as well as things you don't want the scanner to scan. If you wanted to add OpenAPI spec or GraphQL, minimal additional configuration is needed to make that happen, to point the scanner at those industry standard definitions of REST API and GraphQL.