the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 781
require intelligent human involvement to understand the requirements, configure
the testing tools appropriately, and monitor their performance.
Current Products
The market for automated web scanners has thrived in recent years, with a great
deal of innovation and a wide range of different products. Here are some of the
more prominent scanners:
n Acunetix
n AppScan
n Burp Scanner
n Hailstorm
n NetSparker
n N-Stalker
n NTOSpider
n Skipfish
n WebInspect
Although most mature scanners share a common core of functionality, they
have differences in their approaches to detecting different areas of vulnerabilities
and in the functionality presented to the user. Public discussions about
the merits of different scanners often degenerate into mudslinging between
vendors. Various surveys have been performed to evaluate the performance of
different scanners in detecting different types of security flaws. Such surveys
always involve running the scanners against a small sample of vulnerable code.
This may limit the extrapolation of the results to the wide range of real-world
situations in which scanners may be used.
The most effective surveys run each scanner against a wide range of sample
code that is derived from real-world applications, without giving vendors an
opportunity to adjust their product to the sample code before the analysis. One
such academic study by the University of California, Santa Barbara, claims to
be “the largest evaluation of web application scanners in terms of the number
of tested tools ... and the class of vulnerabilities analyzed.” You can download
the report from the study at the following URL:
www.cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf