Re: Experiences with Web application vulnerability assessment (1) software (2) companies

["Hull, Dave" <dphull () KU EDU>]

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Randy Marchany
Sent: Wednesday, February 27, 2008 3:10 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Experiences with Web application vulnerability
assessment (1) software (2) companies

We use:

1. Accunetix - commercial www vulnerability scanner
2. Core Impact - commercial pen test tool
3. Webscarab - freeware www testing tool
4. Paros - freeware www vulnerability scanner with injection testing

Each one reports slight different info but the reports in combination
with a 
good security team analysis should help discover most www app problems.

        -Randy Marchany
        VA Tech IT Security Office & Lab

--- End ---

I have also used Webscarab (available at OWASP) and Paros. Both are web
proxy applications with some overlapping functionality and some unique
capabilities. These are invaluable tools for web app testing.

-- 
Dave