Independent Web Vulnerability Scanner Comparison – Acunetix WVS, IBM Rational AppScan & HP WebInspect


I saw a relevant paper published today by an individual that claims the comparison was ordered by a penetration testing company (a company which remains unnamed).

The vendors were not contacted during or after the evaluation.

Testing Procedure

The author tested 13 web applications (some of them containing a lot of vulnerabilities), 3 demo applications provided by the vendors:

And some tests were done to verify JavaScript execution capabilities.

In total, 16 applications were tested.

An attempt was made to try and cover all the major platforms, so applications in PHP, ASP, ASP.NET and Java were used.

Note for Application Tests:

The report only included “important/critical/major” vulnerabilities like SQL injection, Local/Remote File Inclusion, XSS – Vulnerabilities like “Unencrypted Login Form”, “Directory listing found”, “Email address found” were not included to avoid clutter.

SQL injection vulnerabilities can be discovered through error messages or blind SQL injection. Some scanners are showing 2 alerts: one for the vulnerability found through error message and another for the blind technique. In these cases only one vulnerability has been counted.

The scanners were rated as follows:

Scanner Scoring

You can download the full PDF report here:

WebVulnScanners.pdf

And the associated JavaScript files used for testing here:

WebVulnScanners-JS.zip

The original file location is:

http://drop.io/anantasecfiles/

Author’s blog – http://anantasec.blogspot.com/

Posted in: Countermeasures, Exploits/Vulnerabilities, Security Software, Web Hacking

, , , ,


Latest Posts:


HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.
trident - Automated Password Spraying Tool trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling
tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.


4 Responses to Independent Web Vulnerability Scanner Comparison – Acunetix WVS, IBM Rational AppScan & HP WebInspect

  1. phage101 January 28, 2009 at 12:54 pm #

    That’s brutal at best…

  2. navin January 28, 2009 at 2:01 pm #

    This simply proves what I’ve always felt: Acunetix +Acusensor is the best choice out there

    A bit slower, but extremely valuable!!

    Nice report though!!

    Thanks

  3. Sploo January 28, 2009 at 6:09 pm #

    I think it’s stupid to use the WebInspect demo page. Why wouldn’t WI win for that one!?!

  4. Pantagruel January 29, 2009 at 8:35 am #

    With Navin,

    Yep nice report.
    The amount of missed and false negatives is worrying and it’s a good thing for Acunetix that they appear to do so well. The other should definitely wake up and get improving.