BeSTORM: Dynamic Application Security Testing (DAST) and Black Box Fuzzer

BeSTORM is an intelligent black box fuzzer that ensures the security of products before they are released or deployed. It is built to meet the priorities of efficiency, flexibility, and breadth common to testing teams across the corporate landscape. BeSTORM uses a proprietary prioritization algorithm to automatically start attacking the highest probability vulnerabilities first, before methodically expanding into billions of attacks across the chosen protocols. These protocols can be known, augmented, proprietary, or unknown.

BeSTORM achieves this testing through almost no user interaction. It can be set up outside of the system being tested and can be scaled to use multiple processors or multiple machines to substantially reduce testing duration. It will automatically log anomalies and vulnerabilities and continues testing, eventually producing actionable reports that can be disseminated across teams and acted upon.

A Dynamic Testing Solution

Language Agnostic – BeSTORM runs billions of attacks by testing the binary application and as such is completely indifferent of the programming language or system libraries used.

Scalable – BeSTORM tests the entire communication range. This allows it to scale effortlessly with products with large complicated code bases.

Flexible – The lack of source code interaction also allows for exportation and use of BeSTORM tests to teams that do not have access to the source code.

Fighting tomorrow’s war not yesterday’s battle. Static code tools run perhaps thousands or at best tens of thousands of tests based on a certain set of case studies or scenarios of known vulnerabilities. This is equivalent to bolstering the product against known past attacks. BeSTORM however, performs millions and potentially billions of attack combinations across the entire communication range. This tests the product against not only known past attacks but unknown future ones that may be launched against it.

Comprehensive and Flexible Testing

BeSTORM is capable of testing both already known protocols and quickly learning and testing augmented, proprietary, or new protocols.

Comprehensive

BeSTORM performs across all communication standards (even complex standards, such as SIP), and levels, including network, protocol, file, hardware, DLL and API. BeSTORM delivers an exhaustive search of all possible input combinations to test input implementation for weaknesses. During these tests it operates with a powerful monitor that detects and informs future attacks when even the slightest buffer overflow, format string or memory exception occurs even if these anomalies do not crash the system.

Flexible

BeSTORM supports the analysis of proprietary or augmented protocols. If BeSTORM encounters a proprietary or augmented protocol, BeSTORM’s Auto-Learn will log this and begin building and expanding tests into this protocol. These input types may be network traffic that BeSTORM captured, a file sample that contains the network traffic captured using other means or a syntax describing an API. BeSTORM uses these data sets to determine how the protocol or file is built. If the complete specification is available, users can also create or extend
BeSTORM modules using an XML editor.

BeSTORM is also able to convert protocol standard text into an automated set of tests by converting the BNF description used in technical RFC documents into attack language. This allows BeSTORM to be immediately updated and run on any new communication standards that are released by simply uploading a RFC document or the equivalent.

Actionable Reports

BeSTORM is created with the end goal of remediation in mind. As such, BeSTORM provides clean actionable reports which intricately detail encountered vulnerabilities that ended in a successful attack. Since BeSTORM is behaviorally attacking the test product instead of testing against case studies, virtually all false positives are eliminated leaving the user with comprehensive and clean reports.
Found vulnerabilities can then be exported in a detailed vulnerability report that can be used to debug the application.

Developers can load these vulnerability reports within their chosen development environment with zero knowledge of how to use BeSTORM and immediately begin the debug process.