Validate Web Application Security Vulnerabilities with AppSpider's New Chrome Plug-In

Last updated at Wed, 27 Sep 2017 15:17:21 GMT

AppSpider's Interactive Reports Go Chrome

We are thrilled to announce a significant reporting enhancement to AppSpider, Rapid7's dynamic application security scanner. AppSpider now has a Chrome Plug-in that enables users to open any report in Chrome and be able to use the real-time vulnerability validation feature without the need for Java or having to zip up the folder and send it off. This makes reporting and troubleshooting even easier!

Enabling Security - Developer Collaboration to Speed Remediation

AppSpider is a dynamic application security scanning solution that finds vulnerabilities from the outside-in, just as a hacker would. Our customers tell us that AppSpider not only makes it easier to collaborate with developers, but also speeds remediation efforts. Unlike other application security scanning solutions, we don't just report security weaknesses for security teams to ‘send' to developers. Our solution includes an interactive component that enables developers to quickly and easily review a vulnerability and replay the attack in real-time. This enables them to see how the vulnerability works all from their desktop without having direct access to AppSpider itself - and without learning how to become a hacker.

Related Content [VIDEO] Why it's important to drive application security earlier in the software development lifecycle.

Developers can then use AppSpider's interactive reports to confirm that their fixes have resolved the vulnerability and are actually protecting the application from the weaknesses found. Developer's don't need to have AppSpider installed in their environment to leverage this functionality, just the report, connection to the application they are testing and they're good to go.

Related Content [VIDEO] Watch AppSpider interactive reports in action.

AppSpider Interactive Reports - How it Works

Pretty cool, huh? Well, here's how and why it works...

For those who work in application security, we know all too well that many, if not most, of the application security vulnerabilities we deal with exist in the source code of custom applications that we are responsible for - often in the form of unvalidated inputs. As security professionals, we aren't able to resolve these vulnerabilities (or defects) with a simple patch. We need to work with the developers to resolve security defects, implement coding best business practices and then re-release the new code into production.

At Rapid7, we have understood this for a long time and we have been helping security teams and development teams to collaborate more effectively through AppSpider.

There are many reasons why effective DevSecOps collaboration is difficult. Developers aren't security professionals and reporting security defects to them is easier said than done. We have the logistical issues of emailing around spreadsheets or PDFs and then we have the communication issues related to us speaking security and them speaking to developer. Not to mention the pain of having to go back and forth re-testing their “fixes” to see if they are still vulnerable or not, ‘cause let's face it, most developers wouldn't know a SQL Injection from a Cross Site Request Forgery (CSRF), let alone know how to actually attack their code to see if it's vulnerable to these attack types.

This is an area that we have always shined in however, until today AppSpider required the security professional and the developer to make use of a Java applet to accomplish this within our reports. Now that Chrome and Firefox have disabled Java support, some teams weren't able to leverage this awesome functionality.

Are you looking to upgrade your dynamic application security scanner? Check out AppSpider in action? Check out this on-demand demo of our web application security solution here!