Web Application Security Scanner Article Index for
Web Application 		Website Links For
Web 		 

Information About

Web Application Security Scanner
APPAREL
BABY
BEAUTY
BOOKS
CAR TOYS
CELL PHONES
DVD'S
ELECTRONICS
GOURMET FOOD
GROCERIES
HEALTH & PERSONAL
HOME & GARDEN
JEWELRY
MUSIC
MUSIC INSTRUMENTS
OFFICE PRODUCTS
SOFTWARE
SPORTING GOODS
TOOLS & HARDWARE
TOYS
VIDEO GAMES
SHOPPING HOME
MORE SHOPPING...



Web Application Security Scanners (or Web Application Vulnerability Scanners) are tools designed to automatically scan web applications for vulnerabilities.
These tools work as black-box tester; meaning that, unlike Source Code Scanners, they don't access the source code and then, need to detect the vulnerabilities by performing attacks.


STRENGTHS AND WEAKNESSES

Like every testing tools, the web application security scanner is not a perfect tool, it has strength and weaknesses.

Weaknesses and limitations

  • Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself.

  • It is really hard for a tool to find lots of logical flaws such as the use of weak cryptographic functions

  • Even for technical flaws, if the application doesn't give enough clue, the tool cannot catch it

  • The tool cannot implement all variants of type of attacks for all vulnerabilities, this would take too long time to launch every attacks

  • The tools usually have a bad rate of false-positive but it's mainly due to the testing method itself



Strengths

  • The tool is able to analyze the finalize product and to have a full view of the system

  • It simulate a real attacker by performing attack and try to probe what vulnerabilities are beside the result

  • As a dynamic testing tool, it is not language dependent. A web application scanner is able to scan a JSP, PHP or whatever web application with the same engine.



SOME INSTANCES



Commercial tools



Free/OpenSource Tools


= Web Application Vulnerabilities Scanner projects =
  • The WASC is starting a Web Application Security Scanner Evaluation Criteria (WASSEC) project

  • The NIST is also running a Web Application Security Scanner Evaluation project in the SAMATE project

  • A more general Tool Project from OWASP which include the Web Application Security Scanner