The robot that tries every door
Imagine a robot that visits your website and tries thousands of small tricks. It never gets tired and it works at night.
It will also sometimes shout "danger!" when nothing is wrong, and sometimes stay quiet when something is. Today you learn to read it fairly.
Key words
| Word | What it means |
|---|---|
| Web application scanner | a tool that tests a website or web app for known flaws |
| SQL injection | typed text that tricks a program into giving out stored data |
| Authentication | proving who you are, for example with a password |
| Access control | rules about who may see or change what |
| Third-party | made by another company and used inside your system |
| False positive | a warning about a problem that is not there |
| False negative | no warning about a problem that is there |
| Resources | the power and memory a system has to work with |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what a web application scanner finds and count its false positives and false negatives.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Seven things a web scanner does well
A web application scanner tests a web app and the systems around it. It works by itself.
It discovers SQL injection. It finds if authentication is not working. It shows where data is exposed. It spots wrong access controls and weak or unencrypted connections. It also finds vulnerable third-party parts that the site uses.
The seven strengths
| Strength | A shop example |
|---|---|
| Automatic scanning | It tests every page overnight |
| Discovers SQL injection | The search box gives out stored data |
| Finds broken authentication | A page opens with no login |
| Shows exposed data | A folder of files is open to anyone |
| Finds wrong access controls | A customer can open the admin page |
| Finds vulnerable third-party parts | The shop uses an old add-on with a known flaw |
| Finds weak or unencrypted connections | Login details travel as plain text |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.