1

Is it normal to take 10mins for bdd-security to spider an application? And should the spidering be done after log in or before login?

Basically we have a web application on which we need to do the automated security testing. It's 4-5 page simple web application. When I try to run a test for a simple authentication scenario, it takes 10 mins to spider the application and then runs the test. Is this normal? Because if for each tests it takes so long then it's a waste if time.

For the second part of my question now spidering actually crawls through the base url and finds the underlying hidden urls. If the application requires a login, then will the spidering be effective?

EDIT: It's a spring based web application. Spidering tool is OWASP ZAP.

Improve this question
4
  • Thanks for working to improve your question. I've nominated it to be reopened but it seems others still disagree. Perhaps consider other details you could add or a different way to phrase the question to make it clearer?
    – c32hedge
    Aug 11, 2017 at 18:34
  • Perhaps the folks voting to leave the question closed could leave some comments with additional more specific suggestions for improvement.
    – c32hedge
    Aug 11, 2017 at 18:36
  • Close voters, please look at sqa.meta.stackexchange.com/q/476/25505 on meta
    – c32hedge
    Aug 11, 2017 at 18:57
  • 1
    Please provide more specifics about the technology utilized in your application as well as the spidering technology/tools utilized against the application. As far as the before/after login part...In general it is both as one tests the site itself with permissions and the other tests the same without permissions to ensure that in one all is accessible and in the other none are accessible, so it's two different tests.
    – mutt
    Aug 15, 2017 at 3:56

1 Answer 1

Reset to default
2

First off, with pen testing you will want to ensure all aspects of your application are tested. This includes authenticated login and non-authenticated login. If you are simply spidering the application to find all the URLs then login and try as that will ensure successful connection to all the URLs. If you are pen testing via spidering and running additional tests on each URL then you will want to do both authenticated and non-authenticated tests to ensure each behaves the way it should.

Spring generates things based on the way it's setup and therefore will likely have a bigger structure than what appears to be on the surface. This will likely increase spider time as the spider will reverse engineer the rendered structure to locate all the URL paths that may exist. As the spider finds hidden things it will go down every possible path to locate URLs in the application. This takes time and 10 min. although lengthy, seems reasonable depending on what all is running at the same time via ZAP. URLs must be found, determined viable or not and many checks on these URLs are performed which requires network communication for the handshake checks of each URL. I'm not positive about ZAP settings, but you might be able to adjust some of the settings in the spidering to only check a few things instead of whatever the default settings are. If there are 3 checks on a URL and the handshakes takes 5 sec. now you could be at 15 sec. per URL.

Based on what I'm reading in the question there could be a performance improvement task on the application that you might want to look into. It really depends on the specifics though and if the spider is taking a longer time on the spring arch URL setup and not the user facing GUI then that performance hit likely will never affect the user experience.

Also, consider running the spider in headless mode to take out the GUI rendering time and speed up the process. If this part makes it alot faster then you might also want to look into boosting performance in your GUI rendering.

Improve this answer
2
  • Thanks for the answer it does explain a few things. Actually I'm running zap in daemon mode and using the bdd-security framework to run some automated security checks. So basically when I am spidering an web app through zap does that means it runs all kind of possible tests on it?
    – Swastik
    Aug 15, 2017 at 14:04
  • based on what you are saying it sounds like you are doing all the things the bdd-security framework is setup to check in it's automated security checks. There should be a way to see all that is setup to be checked when it runs. Even if you can't adjust the settings you can see what you are already checking.
    – mutt
    Aug 15, 2017 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.