Penetration Testing mailing list archives
Re: OWASP Top 10 penetration testing software?
From: psiinon <psiinon () gmail com>
Date: Tue, 28 Feb 2012 20:44:41 +0000
Hi, You should be careful with scanners that claim to test "the OWASP Top Ten". For example, "Insecure Cryptographic Storage" is one of the OWASP Top Ten but this is typically only detectable server side, so no web app scanner will find it :) And Insecure Direct Object references are tricky to find in an automated way, but relatively easy for an experienced security tester to find. Automated tools will only be able to find a subset of the top ten, and all of the other potential vulnerabilities (eg application level issues). Dont believe anyone who tells you otherwise :) The OWASP Zed Attack Proxy (ZAP) will find some of the top ten 'automatically', but works best if driven by someone whos looking for issues and knows what to look for. Its a good tool to help you learn how to find issues, but wont do it all for you. No tool will! Psiinon (ZAP Project Lead) On Tue, Feb 28, 2012 at 7:35 PM, webcat <matthew.mckinzie () lewin com> wrote:
Hi, for one of my websites, I have been required to use a web application scanner that tests against the OWASP Top Ten threats. I'm looking for a scanner that does this that is inexpensive or free. Possible scanners I've found for this include the OWASP Zed Attach Proxy Project, Sonar, and w3af, but none of these explicitly tests against the OWASP Top Ten threats (at least not that I can tell). Does anyone know of a scanner that does test against the OWASP Top Ten threats? Thank you! -- View this message in context: http://old.nabble.com/OWASP-Top-10-penetration-testing-software--tp33409197p33409197.html Sent from the Penetration Testing mailing list archive at Nabble.com. ------------------------------------------------------------------------ This list is sponsored by: Information Assurance Certification Review Board Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. http://www.iacertification.org ------------------------------------------------------------------------
-- OWASP ZAP: Toolsmith Tool of the Year 2011 ------------------------------------------------------------------------ This list is sponsored by: Information Assurance Certification Review Board Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. http://www.iacertification.org ------------------------------------------------------------------------
Current thread:
- OWASP Top 10 penetration testing software? webcat (Feb 28)
- Re: OWASP Top 10 penetration testing software? M. Hani Benhailes (Feb 28)
- Re: OWASP Top 10 penetration testing software? webcat (Feb 28)
- Re: OWASP Top 10 penetration testing software? Michele Orru (Feb 28)
- Re: OWASP Top 10 penetration testing software? martin . mngoma (Feb 28)
- Re: OWASP Top 10 penetration testing software? Robert Wood (Feb 28)
- Re: OWASP Top 10 penetration testing software? martin . mngoma (Feb 28)
- Re: OWASP Top 10 penetration testing software? Robert Wood (Feb 28)
- Re: OWASP Top 10 penetration testing software? Tim Gonzales (Feb 28)
- Re: OWASP Top 10 penetration testing software? psiinon (Feb 28)
- Re: OWASP Top 10 penetration testing software? David Mirza (Feb 28)
- Re: OWASP Top 10 penetration testing software? Nathalie Vaiser (Feb 28)
- Re: OWASP Top 10 penetration testing software? M. Hani Benhailes (Feb 28)