LOL. Final Score on the webappsec@subtleplugging.com list:
Acunetix: 2
Appscan: 1
WebScarab: 1
The OWASP 2005 conference will be hosting a presentation covering
around 40 different application assessment tools. About this same time
(first week of April) will launch a new resource on www.owasp.org tracking
said tools.
You other helpful samaritans: Thanks for the Acunetix heads up!
I had not added it to my list, and was surprised to find out that
it's not vaporware.
5 minute first blush of Acunetix "Web Vulnerability Scanner":
Good:
-test editor to get under the hood. Hooray! Nobody (commercial) but
Cenzic has this right now. Good job.
-quick (of course counting it doesn't find much or parse JS :) though
I didn't attempt to test scaling
-no over-hype of "vulnerability" ratings (e.g.-robots.txt isn't "critical")
-usable http editor and the proxy regex support
-no marketing claiming they "automate" what the competition can't,
or do "something" new, or simply demonstrate they don't have a clue
about their competitive landscape.
Opportunities for improvement:
-the "users manual" starts as a marketing document.
-javascript parsing weak or non-existent.
-no ability to fill forms/follow workflow (that I could find).
-found only one of a possible roughly 30 XSS variants I threw at it.
-the one XSS it found, which was the most trivially exploitable
and in a dangerous place, it rated as "medium".
First time I've complained about XSS being under-rated. :)
I was pleasantly surprised by this tool, though the last thing
I think we all need is another "web vulnerability scanner".
Arian Evans
Sr. Security Engineer
FishNet Security
Phone: 816.421.6611
Toll Free: 888.732.9406
Fax: 816.421.6677
http://www.fishnetsecurity.com
-----Original Message-----
From: blad3 [mailto:fd@blad3.ro]
Sent: Thursday, March 03, 2005 3:56 PM
To: El C0chin0
Cc: webappsec
Subject: Re: Web Scanners
A few more (web scanners):
Acunetix Web Vulnerability Scanner (commercial)
http://www.acunetix.com
Watchfire AppScan (commercial)
http://www.watchfire.com/products/security/default.aspx
OWASP WebScarab (free)
http://www.owasp.org/software/webscarab.html
----- Original Message -----
From: "El C0chin0" <mr.nasty@ix.netcom.com>
To: <webappsec@securityfocus.com>
Sent: Thursday, March 03, 2005 1:49 AM
Subject: Web Scanners
I'm looking for different types of web scanners for a proof
of concept
list of vendors or free ones.
I already know of Immunity's Spike and SPI's WebInspect.
I'm looking for
other alternatives. It doens't matter the cost at this
point. I'm looking
for a vendor or vendors who are willing to provide a proof
of concept.
Please respond here if the moderator allows this post.
Thanks
