Go to Top

Focused tests for Rack-based apps using VectorFeed

First real post for this new site so let’s make it a good one, shall we?

Time to give you some background:

As some of you may know I’ve been fortunate enough to have been brought on as one of the contributing authors for the Practical Software Security book to write the dynamic analysis section.

What does that have to do with testing Rack-based apps? you may wonder…

For a collab effort between Arachni and another F/OSS project (more to be announced soon) I had to write the VectorFeed plug-in which accepts serialized vectors and converts them to internal auditable objects in order to perform extremely narrow focused audits — or add even more coverage depending on how you set it up.

On the other hand, me and Justin Collins (who is handling the static analysis section of the book) were talking with Mark Curphey (who is the lead author of the book) about how the subject matter of our respective sections can be integrated into the development process; during said discussion Mark threw in the idea of a Rack middleware gathering data and passing them to Arachni.

It didn’t take long for the idea to get lodged in my head so I had to give it a shot and here’s the result: Rack::ArachniVectorFeed middleware.

You can stick that middleware into any Rack-based application and then take the vector dump it creates and pass it to Arachni’s VectorFeed plug-in to perform either highly focused, unit-test-like security audits or enrich a usual scan with sure things.

First of all, grab the latest code from the experimental branch and let’s go:

Stick the middleware in there

General Rack-based app

Rails 3

Gemfile

config/environments/test.rb

Run your test suite

Now run your tests as usual and the middleware will sits in the middle quietly, extracts all sorts of inputs and dump them in vectors.yml.

Pass the vectors to Arachni

After the tests are done, pass the vectors.yml file to Arachni like so:

For a focused audit

To just audit the inputs from your unit tests run:

To widen the audit scope

But, you may not want a narrow audit but instead use these vectors to extend a usual one:

Also, if you’re on Rails 3 you can further extend the coverage by dynamically exporting all route paths and passing them to to Arachni as well.

Adding more paths

From inside your Rails directory:

And putting everything together:
, , ,

About Tasos Laskos

CEO of Sarosys LLC, founder and lead developer of Arachni.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.