Penetration Testing mailing list archives
RE: Tools comparison and evaluation question (AppScan)
From: "Darren Webb" <spyder007 () charter net>
Date: Sun, 19 Feb 2006 23:34:06 -0600
Hello, You might want to add Burp Suite from http://www.portswigger.net/ when looking at free/low cost tools. As far as commercial tools, we evaluated all of the ones listed below (with the exception of Acunetix) and found Hailstorm provided us with the greatest flexibility and accuracy during use. Their support people are great to work with as well. As far as using Appscan as a reference point, we haven't looked at their latest offering. The version we used was pretty much point, click, report (without a lot of flexibility). Darren -----Original Message----- From: Rory McCune [mailto:rorym () nmrconsult net] Sent: Friday, February 17, 2006 8:01 AM To: Serg Belokamen; pen-test () securityfocus com Subject: Re: Tools comparison and evaluation question (AppScan) Hi, I'm currently looking at evaluating some of the commercial tools in this area, I've not started, so I can't quote on the relatively qualities, but the list of tools I've put together is Commercial Tools ----------------- SPI Webinspect Watchfire AppScan Cenzic HailStorm Protegrity Scando Acunetix Web Vulnerability Scanner In terms of Open Source The only projects I'm aware of (and I'd be interested to hear of others) are Beretta from OWASP and Cruiser from dyadlabs, and as far as I'm aware neither is at a production state at the moment. Cheers Rory Serg Belokamen <serg.belokamen () gmail com> wrote:
Hi All, I am currently looking at using/evaluating a tool called AppScan (by watchfire.com). So the question is in two parts and ASAP reply would be greatly appreciated. First: Without starting a flame war (hopefully) or marketing campaign (another hopefully) can any one tell me abut their experience with the software, what you find useful about it, what not, any annoyances, missing functionality, etc. Second: Can anyone recommend any simular type of software, preferably open source (although not at all essential), and describe its performance, usability and "usefulness" so to speak using AppScan as a reference point. Thanks, Serg ----------------------------------------------------------------------- ----
---
Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ----------------------------------------------------------------------- ----
----
---------------------------------------------------------------------------- -- Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ---------------------------------------------------------------------------- --- ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Tools comparison and evaluation question (AppScan) Serg Belokamen (Feb 17)
- <Possible follow-ups>
- Re: Tools comparison and evaluation question (AppScan) Rory McCune (Feb 17)
- Re: Tools comparison and evaluation question (AppScan) Serg B. (Feb 18)
- RE: Tools comparison and evaluation question (AppScan) Rui Pereira (WCG) (Feb 18)
- Re: Tools comparison and evaluation question (AppScan) Petr . Kazil (Feb 18)
- RE: Tools comparison and evaluation question (AppScan) Darren Webb (Feb 20)