Rodrigo Montoro and Joaquim Espinhara did an interesting test, and like so many interesting tests, it is actually pretty obvious in hindsight: They looked at different vulnerability scanners, and checked how they behave if a web site is coded in a language other then English [1]. The quick answer: They pretty much fail. The presentation is looking at a couple of open source and commercial scanners, and threw in snort as an IDS. Turns out all of the scanners (and snort) have issues recognizing evidence of vulnerabilities (like SQL error messages) if the language is changed to anything but english. Lessons? - don't just trust your vulnerability scanner. A "clean bill" from a basic vulnerability scanner doesn't mean you have no vulnerabilities. On a similar note: Some sites use different code for different language versions of the site. In this case, it is very important to test all language versions, which may not be easy. [1] http://www.slideshare.net/spookerlabs/lost-in-translation-blackhat-brazil-2014 --- |
Johannes 4504 Posts ISC Handler Dec 2nd 2014 |
Thread locked Subscribe |
Dec 2nd 2014 7 years ago |
I could see how this would be difficult with languages that require special characters, such as Chinese languages.
|
Alex 6 Posts |
Quote |
Dec 2nd 2014 7 years ago |
We have 2 videos demo used as PoC
IDS Bypass https://vimeo.com/112510848 Web Scanner bypass https://vimeo.com/112972649 Thanks for helping spread the word. |
Alex 1 Posts |
Quote |
Dec 3rd 2014 7 years ago |
Sign Up for Free or Log In to start participating in the conversation!