My German is not that great. Can I assume the basic summary from
page 149 is as follows?
Sanctum / Watchfire could only find 1 in 5 issues or 20%
WebInspect about 6%
Those are the numbers for one of the two applications (Webgoat).
On the other application (SNM), WebInspect performed clearly better,
and AppScan somewhat better, too.
Accuntix was so bad it wasn't worth reporting results
That was true in any case.
What I didnt see was a comparison of types of issues ie bugs and
flaws? I imagine they are basically all at 0% on flaws but ....
Each and every finding of AppScan and WebInspect on both applications
is listed in detail, covering many pages. However, of course you will
have a hard time with all being in German...
Regarding bugs vs. flaws: The tools found (apart from many false
positive
findings) things like XSS, XST, lacking exception handling in parameter
processing, directory listing, unencrypted login requests - all of them
rather implementation bugs than design flaws, I should say (with the
arguable exception of the unencrypted login). It's hard to imagine a
tool finding design flaws - can you give a good, feasible example?
Hope to have helped,
Holger Peine
--
Dr. Holger Peine, Security and Safety
Fraunhofer IESE, Fraunhofer-Platz 1, 67663 Kaiserslautern, Germany
Phone +49-631-6800-2134, Fax -1299 (shared)
PGP key via http://pgp.mit.edu ; fingerprint is 1BFA 30CB E3ED BA99 E7AE
2BBB C126 A592 48EA F9F8
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase in
the development of any web application. What methodology should be
followed? What tools can accelerate the assessment process?
Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007t9h
--------------------------------------------------------------------------
