WebApp Sec mailing list archives
RE: Re; Comparison report on web app security scanners
From: <Holger.Peine () iese fraunhofer de>
Date: Mon, 15 May 2006 08:54:18 +0200
My German is not that great. Can I assume the basic summary from page 149 is as follows? Sanctum / Watchfire could only find 1 in 5 issues or 20% WebInspect about 6%
Those are the numbers for one of the two applications (Webgoat). On the other application (SNM), WebInspect performed clearly better, and AppScan somewhat better, too.
Accuntix was so bad it wasn't worth reporting results
That was true in any case.
What I didnt see was a comparison of types of issues ie bugs and flaws? I imagine they are basically all at 0% on flaws but ....
Each and every finding of AppScan and WebInspect on both applications is listed in detail, covering many pages. However, of course you will have a hard time with all being in German... Regarding bugs vs. flaws: The tools found (apart from many false positive findings) things like XSS, XST, lacking exception handling in parameter processing, directory listing, unencrypted login requests - all of them rather implementation bugs than design flaws, I should say (with the arguable exception of the unencrypted login). It's hard to imagine a tool finding design flaws - can you give a good, feasible example? Hope to have helped, Holger Peine -- Dr. Holger Peine, Security and Safety Fraunhofer IESE, Fraunhofer-Platz 1, 67663 Kaiserslautern, Germany Phone +49-631-6800-2134, Fax -1299 (shared) PGP key via http://pgp.mit.edu ; fingerprint is 1BFA 30CB E3ED BA99 E7AE 2BBB C126 A592 48EA F9F8 ------------------------------------------------------------------------- Sponsored by: Watchfire Methodologies & Tools for Web Application Security Assessment With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this whitepaper today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007t9h --------------------------------------------------------------------------
Current thread:
- Re; Comparison report on web app security scanners jack.jonburg (May 12)
- <Possible follow-ups>
- RE: Re; Comparison report on web app security scanners Holger.Peine (May 15)
- Re: RE: Re; Comparison report on web app security scanners ma . huijuan (May 15)
- RE: RE: Re; Comparison report on web app security scanners Martin O'Neal (May 15)