Tuesday, January 27, 2009

Web Vulnerability Scanners Comparison

In the past weeks, I've performed an evaluation/comparison of three popular web vulnerability scanners.This evaluation was ordered by a penetration testing company that will remain anonymous. The vendors were not contacted during or after the evaluation.

The applications (web scanners) included in this evaluation are:
- Acunetix WVS version 6.0 (Build 20081217)
- IBM Rational AppScan version 7.7.620 Service Pack 2
- HP WebInspect version 7.7.869

I've tested 13 web applications (some of them containing a lot of vulnerabilities), 3 demo applications provided by the vendors (testphp.acunetix.com, demo.testfire.net, zero.webappsecurity.com) and I've done some tests to verify Javascript execution capabilities.

In total, 16 applications were tested. I've tried to cover all the major platforms, therefore I have applications in PHP, ASP, ASP.NET and Java.

The report can be found at http://drop.io/anantasecfiles/
The full URL to the PDF document: http://drop.io/download/497f0f4e/c1d8b2966f85fb8549a18cbe2d789224ea665f45/759c3010-ce68-012b-dcee-f407c7ff11c2/9eeb1f00-cea5-012b-aa7b-f219675fa758/report.pdf/report_pdf.pdf

I've included enough information in this report (the javascript files used for testing, exact version and URL for all the tested applications) so anybody with enough patience can verify and reproduce the results presented here.

Therefore, I will not respond to emails for vendors. You have the information, fix your scanners!
Posted by at
Labels: , , , , ,

45 comments:

  1. Billy (BK) RiosJanuary 28, 2009 at 7:57 AM

    Excellent report. I too preferred AppScan, but your report has me thinking twice. Great Job!

    Billy Rios

    ReplyDelete
  2. AnantaSecJanuary 28, 2009 at 10:25 AM

    Thank you very much Billy.
    BTW, I'm following your blog. You have some great posts in there.

    ReplyDelete
  3. JordanFebruary 1, 2009 at 7:09 PM

    Drop.io link is broken?

    ReplyDelete
  4. AnonymousMarch 25, 2009 at 11:56 PM

    Hi Nice Blog.web based timecard Labor Time Tracker is a “labor time tracker” for your business. It is a smarter, easier and faster way to track employee time for payroll and job costing.

    ReplyDelete
  5. dahowardMarch 26, 2009 at 3:17 PM

    Not sure if anyone saw this, but Acunetix (who won) must be listening, because they claim they now catch everything in this test suite...
    http://www.acunetix.com/blog/productnews/updated-acunetix-wvs-addresses-anantas-comparison-report-issues/

    ReplyDelete
  6. nicoJuly 31, 2009 at 8:15 AM

    Thanks, the report is very helpfull.

    I try to reproduce the javascript tests and acunetix doen't report any problem with the javascript files you provided.

    Can you comment what are the vulnerabilities present in javascript files?

    maybe is the configuration of acunetix, but I tried too with w3af and nothing is reported.

    nico

    ReplyDelete
  7. 腳亞子February 2, 2010 at 1:11 AM

    wonderful ..................................................

    ReplyDelete
  8. AnonymousFebruary 27, 2010 at 5:11 AM

    很喜歡你的blog哦...加油唷 ........................................

    ReplyDelete
  9. AnonymousMarch 18, 2010 at 1:28 AM

    how do u do?

    ReplyDelete
  10. AnonymousMarch 29, 2010 at 3:48 AM

    If you lend someone $20 and never see that person again, it was probably worth it.............................................

    ReplyDelete
  11. AnonymousApril 7, 2010 at 6:21 PM

    TAHNKS FOR YOUR SHARING~~~VERY NICE.................................................

    ReplyDelete
  12. AnonymousApril 17, 2010 at 3:02 AM

    Nice blog85cc,咆哮小老鼠,85街,免費影片,情趣爽翻天,愛戀情人用品,交友找啦咧,線上a片,女同志聊天室,sexy,色情網站,網愛聊天室,情色性愛貼圖,小穴,性愛姿勢,陰脣室,成人圖貼,性愛技巧,a片論壇,色情,85c,sexy網,人妻,脫衣,6k,18禁,手淫,性幻想,77p2p,情色,1007,85c,0401,後宮,色情,淫蕩,正妹,77p2p,ut室

    ReplyDelete
  13. MaximilianApril 17, 2010 at 8:27 AM

    Hi AnantaSec,

    would be nice if you could confirm this.
    http://labs.german-websecurity.com/en/blog/?p=12

    If you need a free scan from german-websecurity.com for this test, just send them a email.

    ReplyDelete
  14. AnonymousApril 24, 2010 at 8:54 PM

    偉大的致富萬能之鑰，正是幫你充分掌握自己心志所必須的自律自制..............................

    ReplyDelete
  15. AnonymousMay 5, 2010 at 7:45 PM

    非常感謝~3Q~....................................................

    ReplyDelete
  16. AnonymousMay 10, 2010 at 7:43 PM

    Gods mill grinds slow but sure...................................................

    ReplyDelete
  17. AnonymousMay 21, 2010 at 11:13 AM

    幸福是人人都要，又怎麼可能都歸你所有？要知道這世界幸福本來就不多 ..................................................

    ReplyDelete
  18. AnonymousMay 29, 2010 at 1:36 PM

    知足常樂~~有這麼好的文章，人生足矣~~哈哈 ....................................................

    ReplyDelete
  19. AnonymousJune 4, 2010 at 4:02 AM

    我們不是因為快樂而歌唱，而是唱歌使我們快樂..................................................

    ReplyDelete
  20. AnonymousJune 7, 2010 at 7:06 PM

    好文章給人的感覺就是很好，謝謝您~~........................................

    ReplyDelete
  21. AnonymousJune 11, 2010 at 12:29 AM

    Beauty, unaccompanied by virtue, is as a flower without perfume...................................................

    ReplyDelete
  22. AnonymousJune 14, 2010 at 6:13 PM

    憂能傷身，保重哦！........................................

    ReplyDelete
  23. AnonymousJune 27, 2010 at 12:47 AM

    死亡是悲哀的，但活得不快樂更悲哀。.................................................................　　　　　　　　　　　　　　　　　　　　　　　　　　　

    ReplyDelete
  24. AnonymousJune 30, 2010 at 10:31 AM

    Quality is better than quantity.....................................................................

    ReplyDelete
  25. AnonymousJuly 4, 2010 at 12:39 AM

    人生是故事的創造與遺忘。............................................................

    ReplyDelete
  26. AnonymousJuly 7, 2010 at 10:55 PM

    當一個人內心能容納兩樣相互衝突的東西，這個人便開始變得有價值了。............................................................

    ReplyDelete
  27. AnonymousJuly 10, 2010 at 4:44 AM

    Rome was not built in a day............................................................

    ReplyDelete
  28. AnonymousJuly 14, 2010 at 6:00 PM

    有用的才華若不用，便如同日晷儀放在陰暗之中............................................................

    ReplyDelete
  29. AnonymousJuly 17, 2010 at 12:04 AM

    好文章就值得回響，如果可以常常看到您的更新，應該是件很幸福的事情~~............................................................

    ReplyDelete
  30. AnonymousJuly 19, 2010 at 3:48 PM

    這麼好的部落格，以後看不到怎麼辦啊！！！..................................................................

    ReplyDelete
  31. AnonymousJuly 22, 2010 at 12:22 AM

    我們能互相給予的最佳禮物是「真心的關懷」。..................................................

    ReplyDelete
  32. AnonymousJuly 22, 2010 at 12:22 AM

    下次再來希望可以看到新的作品喔。..................................................................

    ReplyDelete
  33. AnonymousJuly 24, 2010 at 10:39 PM

    不論做什麼事，相信自己，別讓別人的一句話，把你擊倒。..................................................

    ReplyDelete
  34. AnonymousJuly 27, 2010 at 8:06 PM

    男女互悅，未必廝守終生，相愛就是美的。.................................................................

    ReplyDelete
  35. AnonymousAugust 2, 2010 at 11:21 PM

    愛，拆開來是心和受兩個字。用心去接受對方的一切，用心去愛對方的所有。......................................................................

    ReplyDelete
  36. 家唐銘August 5, 2010 at 9:13 PM

    拒絕冒險和成長的人，終將被生命的潮流陶汰。..................................................

    ReplyDelete
  37. AnonymousAugust 5, 2010 at 9:13 PM

    每日都有新日光，每日都有新希望。.................................................

    ReplyDelete
  38. 凱許倫August 8, 2010 at 2:27 PM

    人生是故事的創造與遺忘。............................................................

    ReplyDelete
  39. AnonymousAugust 13, 2010 at 9:49 AM

    你的部落內容真棒，一定要持續下去! .................................[/url]...............

    ReplyDelete
  40. AnonymousAugust 15, 2010 at 8:28 AM

    每次看完你的文章，總是回味許久，要經常發表喔。..................................................

    ReplyDelete
  41. AnonymousAugust 17, 2010 at 7:39 PM

    這麼用心的經營你的文章, 當然值得我們留連拜訪的！...............................................................

    ReplyDelete
  42. AnonymousAugust 20, 2010 at 12:14 AM

    多謝美味的心靈雞湯......................................................

    ReplyDelete
  43. AnonymousAugust 22, 2010 at 2:13 PM

    你的分享很不錯.. 謝謝 ..................................................

    ReplyDelete
  44. sesiliaNovember 20, 2012 at 11:39 PM

    Its great to know about PTLLS Course announcement. This is the edge of competition and one have to be skillful before joining a career.This would help you to ensure your security.

    ReplyDelete
  45. Catherine WinsletJune 14, 2019 at 6:27 AM

    For people who stay in those grandfathered plans, the pool of subscribers in the plan are going to start to shrink, and as that happens, the cost of those grandfathered health insurance plans will increase even faster than they are now. Just Keto Therefore, people in grandfathered health plans will also be impacted by ObamaCare.

    ReplyDelete

Subscribe to: Post Comments (Atom)