N-Stalker Web Application Security Scanner is shipped in three commercial editions specially designed to fit your needs, including: - QA Edition(Development and SQA tests) For developers and Software Quality Assurance Professionals, a solution to assess your custom web application. Infrastructure Edition(Web Server Infrastructure Security). N-Stalker Infrastructure Edition: 40% Service subscription can only be renewed in multiples of 1 year. The starting date of Web Security Intelligent Service is always the date when the product was firstly purchased.
Description
Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration. This category of tools is frequently referred to as Dynamic Application Security Testing (DAST) Tools. A large number of both commercial and open source tools of this type are available and all of these tools have their own strengths and weaknesses. If you are interested in the effectiveness of DAST tools, check out the OWASP Benchmark project, which is scientifically measuring the effectiveness of all types of vulnerability detection tools, including DAST.
Here we provide a list of vulnerability scanning tools currently available in the market.
Disclaimer: The tools listing in the table below are presented in alphabetical order. OWASP does not endorse any of the Vendors or Scanning Tools by listing them in the table below.
OWASP is aware of the Web Application Vulnerability Scanner Evaluation Project (WAVSEP). WAVSEP is completely unrelated to OWASP and we do not endorse its results, nor any of the DAST tools it evaluates. However, the results provided by WAVSEP may be helpful to someone interested in researching or selecting free and/or commercial DAST tools for their projects. This project has far more detail on DAST tools and their features than this OWASP DAST page.
Tools Listing
- Abbey Scan
- Owner: MisterScanner
- License: Free
- Platforms: SaaS
- Acunetix WVS
- Owner: Acunetix
- License: Commercial / Free (Limited Capability)
- Platforms: Windows
- Application Security on Cloud
- Owner: IBM
- License: Commercial
- Platforms: SaaS
- AppScan
- Owner: IBM
- License:
- Platforms: Windows
- App Scanner
- Owner: Trustwave
- License: Commercial
- Platforms: Windows
- AppSpider
- Owner: Rapid7
- License: Commercial
- Platforms: Windows
- AppTrana Website Security Scan
- Owner: AppTrana
- License: Free
- Platforms: SaaS
- Arachni
- Owner: Arachni
- License: Free for most use cases
- Platforms: Most platforms supported
- AVDS
- Owner: Beyond Security
- License: Commercial / Free (Limited Capability)
- Platforms: SaaS
- BlueClosure BC Detect
- Owner: BlueClosure
- License: Commercial, 2 weeks trial
- Platforms: Most platforms supported
- BREACHLOCK Dynamic Application Security Testing
- Owner: BREACHLOCK
- License: Commercial
- Platforms: SaaS
- Burp Suite
- Owner: PortSwiger
- License: Commercial / Free (Limited Capability)
- Platforms: Most platforms supported
- Contrast
- Owner: Contrast Security
- License: Commercial / Free (Full featured for 1 App)
- Platforms: SaaS or On-Premises
- Detectify
- Owner: Detectify
- License: Commercial
- Platforms: SaaS
- Digifort- Inspect
- Owner: Digifort
- License: Commercial
- Platforms: SaaS
- edgescan
- Owner: edgescan
- License: Commercial
- Platforms: SaaS
- GamaScan
- Owner: GamaSec
- License: Commercial
- Platforms: Windows
- Grabber
- Owner: Romain Gaucher
- License: Open Source
- Platforms: Python 2.4, BeautifulSoup and PyXML
- Gravityscan
- Owner: Defiant, Inc.
- License: Commercial / Free (Limited Capability)
- Platforms: SaaS
- Grendel-Scan
- Owner: David Byrne
- License: Open Source
- Platforms: Windows, Linux and Macintosh
- GoLismero
- Owner: GoLismero Team
- License: GPLv2.0
- Platforms: Windows, Linux and Macintosh
- IKare
- Owner: ITrust
- License: Commercial
- Platforms: N/A
- ImmuniWeb
- Owner: High-Tech Bridge
- License: Commercial / Free (Limited Capability)
- Platforms: SaaS
- InsightVM
- Owner: Rapid7
- License: Commercial with Free Trial
- Platforms: SaaS
- Intruder
- Owner: Intruder Ltd.
- License:
- Platforms:
- Indusface Web Application Scanning
- Owner: Indusface
- License: Commercial / Free Trial
- Platforms: SaaS
- N-Stealth
- Owner: N-Stalker
- License: Commercial
- Platforms: Windows
- Nessus
- Owner: Tenable
- License: Commercial
- Platforms: Windows
- Netsparker
- Owner: MavitunaSecurity
- License: Commercial
- Platforms: Windows
- Nexpose
- Owner: Rapid7
- License: Commercial / Free (Limited Capability)
- Platforms: Windows/Linux
- Nikto
- Owner: CIRT
- License: Open Source
- Platforms: Unix/Linux
- Probely
- Owner: Probely
- License: Commercial / Free (Limited Capability)
- Platforms: SaaS
- Proxy.app
- Owner: Websecurify
- License: Commercial
- Platforms: Macintosh
- QualysGuard
- Owner: Qualys
- License: Commercial
- Platforms: N/A
- Retina
- Owner: BeyondTrust
- License: Commercial
- Platforms: Windows
- Securus
- Owner: Orvant, Inc
- License: Commercial
- Platforms: N/A
- Sentinel
- Owner: WhiteHat Security
- License: Commercial
- Platforms: N/A
- SOATest
- Owner: Parasoft
- License: Commercial
- Platforms: Windows / Linux / Solaris
- Tinfoil Security
- Owner: Tinfoil Security, Inc.
- License: Commercial / Free (Limited Capability)
- Platforms: SaaS or On-Premises
- Trustkeeper Scanner
- Owner: Trustwave SpiderLabs
- License: Commercial
- Platforms: SaaS
- Vega
- Owner: Subgraph
- License: Open Source
- Platforms: Windows, Linux and Macintosh
- Vex
- Owner: UBsecure
- License: Commercial
- Platforms: Windows
- Wapiti
- Owner: Informática Gesfor
- License: Open Source
- Platforms: Windows, Unix/Linux and Macintosh
- Web Security Scanner
- Owner: DefenseCode
- License: Commercial
- Platforms: On-Premises
- WebApp360
- Owner: TripWire
- License: Commercial
- Platforms: Windows
- WebCookies
- Owner: WebCookies
- License: Free
- Platforms: SaaS
- WebInspect
- Owner: Micro Focus
- License: Commercial
- Platforms: Windows
- WebReaver
- Owner: Websecurify
- License: Commercial
- Platforms: Macintosh
- WebScanService
- Owner: German Web Security
- License: Commercial
- Platforms: N/A
- Websecurify Suite
- Owner: Websecurify
- License: Commercial / Free (Limited Capability)
- Platforms: Windows, Linux, Macintosh
- Wikto
- Owner: Sensepost
- License: Open Source
- Platforms: Windows
- w3af
- Owner: w3af.org
- License: GPLv2.0
- Platforms: Linux and Mac
- Zed Attack Proxy
- Owner: OWASP
- License: Open Source
- Platforms: Windows, Unix/Linux and Macintosh
References
- SAST Tools - OWASP page with similar information on Static Application Security Testing (SAST) Tools
- Free for Open Source Application Security Tools - OWASP page that lists the Commercial Dynamic Application Security Testing (DAST) tools we know of that are free for Open Source
- http://sectooladdict.blogspot.com/ - Web Application Vulnerability Scanner Evaluation Project (WAVSEP)
- http://projects.webappsec.org/Web-Application-Security-Scanner-Evaluation-Criteria - v1.0 (2009)
- http://www.slideshare.net/lbsuto/accuracy-and-timecostsofwebappscanners - White Paper: Analyzing the Accuracy and Time Costs of WebApplication Security Scanners - By Larry Suto (2010)
- http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners.html - NIST home page which links to: NIST Special Publication 500-269: Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 (21 August, 2007)
- http://www.softwareqatest.com/qatweb1.html#SECURITY - A list of Web Site Security Test Tools. (Has both DAST and SAST tools)
Another Web security scanner to check out
OK, I covered Acunetix Web Vulnerability Scanner in a previous post and now it’s time to share a bit about another Web vulnerability scanner called N-Stalker Web Application Security Scanner 2009. I’ve used N-Stalker for a while dating back to when it was a free product nearly 10 years ago. Compared to the competition I must to admit that I haven’t been really impressed with the tool until now. Thiago Zaninotti – the product’s founder and developer – seems to have taken things up to the right level with the latest version.
The version of N-Stalker I’ve been using is the Enterprise Edition as shown in the following screenshot:
N-Stalker 2009’s new interface is one of the best around
There’s a free edition of N-Stalker you should check out. They even offer a QA edition for use in the middle of the SDLC.
I like that N-Stalker includes policies for OWASP Top 10 and CWE Top 25 checks…it also has a web proxy (something you have to have for manual testing) as well as a HTTP brute force password cracker (although, like other vendors, it’s not really a “brute force” cracker in the traditional sense but rather a dictionary-based cracker). I’ve yet to find a true Web-centric brute-force password cracker other than Brutus which is getting some age on it and is no longer maintained.
Another really cool thing is that N-Stalker comes with a Web server load tester…something I’ve had a need for many times in the past for DoS testing but have not had access to at least in the context of a Web vulnerability scanner. Very cool.
In using it, a few things really stood out that I liked a lot:
- You can change the scanner threads on the fly to throttle the requests without even having to pause the scan.
- It has specific optimization settings for scanning generic HTTP devices such as routers (hosts with Web servers many people overlook in their security testing).
- You can load a second instance of the program so you can run multiple scans at once…although it did seem to really slow things down.
- It let’s you view not only the site tree (all of the files/folders in the site/app) but also an Ajax tree outlining all the Ajax related content on the site/app.
There are some downsides:
- I’m not crazy about the signature-based approach the scanner uses. It seems to run every check in a serial fashion with multiple iterations through the same file structure. My experience has been that it can take a very long time to complete a scan…sometimes to the point where I just have to stop it altogether.
- I couldn’t find a “full scan” policy option that would test everything – not just OWASP Top 10, buffer overflows, XSS, SQL injection, and so on.
- There’s no real obvious way of determining at a glance how much time (or percentage) is left on the scan.
- Program updates require you to step through the installation process and even (re)accept the license agreement.
- The reports could be more intuitive.
All in all N-Stalker is a formidable tool especially for SMBs on a budget or if you’re just getting started down the Web security path. It’s also reasonably priced especially if cost is as important as brand name…Probably the best thing about it is the responsiveness I get from Thiago and his team. It’s almost immediate. I even found an issue that was causing an error when I exited the program that appears to be fixed. All in all, N-Stalker is definitely worth taking for a spin.