the-web-application-hackers-handbook

782 Chapter 20 n A Web Application Hacker’s Toolkit
The main conclusions of this study were as follows:
n Whole classes of vulnerabilities cannot be detected by state-of-the-art scanners,
including weak passwords, broken access controls, and logic flaws.
n The crawling of modern web applications can be a serious challenge for
today’s web vulnerability scanners due to incomplete support for common
client-side technologies and the complex stateful nature of today’s
applications.
n There is no strong correlation between price and capability. Some free or
very cost-effective scanners perform as well as scanners that cost thousands
of dollars.
The study assigned each scanner a score based on its ability to identify different
types of vulnerabilities. Table 20-1 shows the overall scores and the price
of each scanner.
Table 20-1: Vulnerability Detection Performance and Prices of Different Scanners According
to the UCSB Study
SCANNER SCORE PRICE
Acunetix 14 $4,995 to $6,350
WebInspect 13 $6,000 to $30,000
Burp Scanner 13 $191
N-Stalker 13 $899 to $6,299
AppScan 10 $17,550 to $32,500
w3af 9 Free
Paros 6 Free
HailStorm 6 $10,000
NTOSpider 4 $10,000
MileSCAN 4 $495 to $1,495
Grendel-Scan 3 Free
It should be noted that scanning capabilities have evolved considerably in
recent years and are likely to continue to do so. Both the performance and
price of individual scanners are likely to change over time. The UCSB study
that reported the information shown in Table 20-1 was published in June 2010.
Because of the relative scarcity of reliable public information about the performance
of web vulnerability scanners, it is recommended that you do your
own research before making any purchase. Most scan vendors provide detailed
product documentation and free trial editions of their software, which you can
use to help inform your product selection.