In the past weeks, I've performed an evaluation/comparison of three popular web vulnerability scanners.This evaluation was ordered by a penetration testing company that will remain anonymous. The vendors were not contacted during or after the evaluation.
The applications (web scanners) included in this evaluation are:
- Acunetix WVS version 6.0 (Build 20081217)
- IBM Rational AppScan version 7.7.620 Service Pack 2
- HP WebInspect version 7.7.869
I've tested 13 web applications (some of them containing a lot of vulnerabilities), 3 demo applications provided by the vendors (testphp.acunetix.com, demo.testfire.net, zero.webappsecurity.com) and I've done some tests to verify Javascript execution capabilities.
In total, 16 applications were tested. I've tried to cover all the major platforms, therefore I have applications in PHP, ASP, ASP.NET and Java.
The report can be found at http://drop.io/anantasecfiles/
The full URL to the PDF document: http://drop.io/download/497f0f4e/c1d8b2966f85fb8549a18cbe2d789224ea665f45/759c3010-ce68-012b-dcee-f407c7ff11c2/9eeb1f00-cea5-012b-aa7b-f219675fa758/report.pdf/report_pdf.pdf
I've included enough information in this report (the javascript files used for testing, exact version and URL for all the tested applications) so anybody with enough patience can verify and reproduce the results presented here.
Therefore, I will not respond to emails for vendors. You have the information, fix your scanners!
Subscribe to:
Post Comments (Atom)
Excellent report. I too preferred AppScan, but your report has me thinking twice. Great Job!
ReplyDeleteBilly Rios
Thank you very much Billy.
ReplyDeleteBTW, I'm following your blog. You have some great posts in there.
Drop.io link is broken?
ReplyDeleteNot sure if anyone saw this, but Acunetix (who won) must be listening, because they claim they now catch everything in this test suite...
ReplyDeletehttp://www.acunetix.com/blog/productnews/updated-acunetix-wvs-addresses-anantas-comparison-report-issues/
Thanks, the report is very helpfull.
ReplyDeleteI try to reproduce the javascript tests and acunetix doen't report any problem with the javascript files you provided.
Can you comment what are the vulnerabilities present in javascript files?
maybe is the configuration of acunetix, but I tried too with w3af and nothing is reported.
nico
Hi AnantaSec,
ReplyDeletewould be nice if you could confirm this.
http://labs.german-websecurity.com/en/blog/?p=12
If you need a free scan from german-websecurity.com for this test, just send them a email.
For people who stay in those grandfathered plans, the pool of subscribers in the plan are going to start to shrink, and as that happens, the cost of those grandfathered health insurance plans will increase even faster than they are now. Just Keto Therefore, people in grandfathered health plans will also be impacted by ObamaCare.
ReplyDeleteYou will likely to lose the self-confidence when people start passing comments and laughing on you for a thing which you did mistakenly - in fact, ignorantly! Remember! Ignorance is no EXCUSE, especially in this age of information. Lip Liner Tips
ReplyDeleteOur first essential item for maintaining your state of beauty is your moisturizing foundation. Foundation helps to give your skin even tone and healthy color. You will also want a moisturizing foundation with a high SPF to protect your skin from damage due to sun exposure. FairyMines
ReplyDeleteThere are magicians you will tell you that they do everything - illusions, comedy, strolling, but that is because they are not proficient at any specific style, so all their shows are usually only mediocre. Family of Thakurganj full movie download
ReplyDelete
ReplyDeleteort time instead of a longer time but not working hard. Ultra Fast Keto Boost
This saves you money because you won't waste food that you already have. This saves you from having food go bad or expire. Trendy Mumi
ReplyDeleteWith the rapidly changing landscape of education as whole, taking on the challenge of designing multi-functional educational facilities means more than just designing a building. From technology to curriculums, campus structure to classroom environments, those involved in the planning, design and construction must be dedicated to providing solutions that meet the distinct needs of today's students. USA Fitness Plan
ReplyDeletetogel online
ReplyDeletebandar togel terpercaya
agen togel
judi togel
Nice Aricle
ReplyDeleteCome and win with us
SahabatQQ
Agen Domino99
do you know when a person dies we will write the word rip to pray god to rest his/her soul. read the full form of rip on hindi.
ReplyDeleteglucose 1 reviews
ReplyDelete