HP webinspect

All posts tagged HP webinspect

Web application penetration testing refers to evaluating the security of websites and web applications. Websites evolved from being simple static HTML pages to incorporate complex dynamic features with bells and whistles. These bells and whistles also brought with them lot of vulnerabilities and thus websites became common targets for hackers. So web application penetration testing is considered very important nowadays.

WAPT could be performed manually or through automatic tools. Automated tools provide lot of advantages over manual testing most importantly the speed. HP Webinspect is one such tool.

It is an automated web application security scanning tool from HP. It helps the security professionals to assess the potential vulnerabilities in the web application. It is basically an automated dynamic application security testing (DAST) tool that mimics real-world hacking techniques and attacks, and provides comprehensive dynamic analysis of complex web applications and services. See how to install HPwebinspect in Windows.

Today we will see how to perform website vulnerability assessment with HPWebinspect. Open the program and click on basic scan. We will see other scan options in the following parts of this tutorial. As its name implies, this option performs a basic security scan on a website.

webinspectbasicscan1

As we select the basic scan option, the “scan wizard” opens as shown below. As I am using a trial version of HPWebinspect I am only allowed to scan the website deliberately provided by HP for this purpose. This website simulates a bank ( named zero bank ) and this will be our target from now on.

I allot the given name. Below the scan name option, we have features with radio buttons. Let’s see these options.

crawl:- This process makes a list of all the pages  on the entire website and builds its structure.

auditing:- Auditing is the process in which HPwebinspect will attack the website to find out the vulnerabilities.

I have selected the “crawling and auditing” option. HP Webinspect provides four types of scans.

Standard scan:- Normal scan.
List Driven scan:- You can specify the list of urls for the tool to scan. It will only scan those urls.
Workflow Driven scan:- Similar to list driven scan. You can scan a port of your website by specifying a macro.
Manual scan:- You can specify each link you want to scan. step by step.

Next specify the website you want to scan and click on “Next”.

webinspectbasicscan2

In the next window, you will be prompted for authentication. If your website or network requires authentication, provide them . Choose if you want network proxy or not and click on “Next“.

webinspectbasicscan3

The profiler automatically samples the website and recommends best configuration for the scan. You can select the option. We will see more about profiler later. There are some other settings. Leave them to their default settings and click on “Next”.

webinspectbasicscan4

You will get a congrats message telling about the successful configuration of scan settings. It’s time to start the scan. Click on “scan”.

webinspectbasicscan5

The scan will start as shown below. It will take some time dependent on the size of the website you are scanning.

webinspectbasicscan6

After the scan is finished, it will show the results as shown below. This tool classifies vulnerabilities into critical, high, medium, low and info. That was about basic scanning of website with HPWebinspect.

webinspectbasicscan7

In our next part, we will see analyzing these vulnerabilities.

Webinspect is an automated web application security scanning tool from HP. It helps the security professionals to assess the potential vulnerabilities in the web application. It is basically a dynamic black box testing tool which detects the vulnerabilities by actually performing the attack. Today we will see how to install HP Webinspect in Windows.

We will be installing it on Windows 10. HP Webinspect requires SQL server to be installed on the system. So first install SQL server express on Windows as shown here. After SQL server is installed successfully, download the latest version of HP Webinspect from their website. We will use version 16.10 for this howto. Right click on the downloaded file and run with administrator privileges.

The installation wizard will start with the welcome message as shown below. Click on”Next”.

hpwebinspect1

Accept the license agreement and click on “Next”.

hpwebinspect2

You can change the installation folder if you want although keeping it default will not hurt. Click on “Next”.

hpwebinspect3

If you want to setup Webinspect as a sensor, select the option and click on “Next”.

hpwebinspect4

Click on “Install” to start installation process.

hpwebinspect5

Once the installation is over, it will show you the below window. If you want to start HP webinspect, select the option and click on “Finish”.

hpwebinspect6

The program will launch as shown below.

hpwebinspect7

If you get something like below, you have no SQL server installed on your system. Install SQL server express and launch the program again.

hpwebinspect8

The program will prompt you for activation as shown below. The program also offers 15 days trial. I am registering for the trial.

hpwebinspect9

hpwebinspect10

Once the registration process is over, the program will open as shown below. Update the program. In our next howto, We will see how to perform  web app pentesting with HP Webinspect. Until then, Happy Weekend.

hpwebinspect12