The Open Web Application Security Project (OWASP) recently made Sprajax available for free download. It is an open...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
source security scanner developed specifically to scan Ajax Web applications for potential security vulnerabilities. I have no doubt that this will become a great tool, but at present I wouldn't call it comprehensive. You can download Sprajax at the site. AT OWASP you will also find advice on developing secure Ajax applications and you can sign up to receive a complementary security scan from Acunetix Ltd.
On the other hand, if your budget allows for an Ajax vulnerability-assessment tool, you may consider Cenzic Inc.'s updated Hailstorm product. The newly updated tool can now scan Ajax-enabled applications. Although not every XML- and SOA-specific vulnerability is covered, Hailstorm can use an internal browser to detect errors based on actual responses received from the application, which is much better than relying on signature-based scans. The product can also perform session-based assessments of vulnerabilities like session hijacking, a tactic that signature-based scans cannot detect. SPI Dynamics Inc.'s WebInspect is another scanner worth reviewing. One of its many tests checks for authentication and authorization of dynamic links to scripts on the server.
Finally, when you develop your Ajax applications, try to keep them as uncomplicated as possible. Reducing and simplifying any Ajax call will make it easier to evaluate the possible types of requests that a page or application generates. Also, make sure to document and explain how the application communicates with the server and how it handles responses. This will make it easier to evaluate whether there is a possible security flaw in the code. The key coding discipline of never trusting data from the client still applies. Any security controls should be implemented on the server and never be under the control of the user.
Dig Deeper on Web Services Security and SOA Security
Related Q&A from Michael Cobb
The TLS protocol has fallen on hard times, but expert Michael Cobb explains how client puzzles can help fix some of the problems.continue reading
Microsoft's Wi-Fi Sense for Windows 10 can share encrypted passwords for Wi-Fi networks, but is it safe? Expert Michael Cobb has the answer.continue reading
Several security vendors and providers have been hacked over the last year. Expert Michael Cobb explains how enterprises should prepare for a vendor ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.