[WEB SECURITY] RE: Web Application Scanners Comparison

Rafal @ IsHackingYou.com rafal at ishackingyou.com
Wed Jan 28 20:41:47 EST 2009

    You're right, and further to that point I'm going to concur with what
Vinnie Liu said in his BlueHat presentation... (paraphrasing) "anyone that
says that black-box scanners are useless because they don't find as many
vulns as a human is speaking clearly from inexperience".  Absolutely.

    It doesn't matter how "good" you are at finding bugs in code, unless the
code has a low complexity factor, and you're incredibly focused for a long
period of time I'm going to argue that a "scanner" is a necessary
complement.  I say complement because often-time the more experienced
assessors will use some black-box scanner tool to supplement their efforts
and keep them sane.

    You said it brilliantly - a little from column A, and a little from
column B is what's needed... but believe me when I say that this is more of
an exception than the rule.  Companies want it simple, with the click of a
button, and cheap, and now.  Scanners solve some of that problem, and
often-times it helps check the compliance box, so they buy it no matter what
the sales people say.  Although I would agree, sales people generally suck.

Rafal M. Los
Security & IT Risk Strategist

 - Blog:         http://preachsecurity.blogspot.com
 - LinkedIn:  http://www.linkedin.com/in/rmlos

From: "Martin O'Neal" <martin.oneal at corsaire.com>
Sent: Wednesday, January 28, 2009 3:16 PM
To: "Rafal @ IsHackingYou.com" <rafal at ishackingyou.com>; "Albert"
<caruabertu at gmail.com>; <r at fuckthespam.com>
Cc: <pen-test at securityfocus.com>; <webappsec at securityfocus.com>;
<websecurity at webappsec.org>
Subject: RE: [WEB SECURITY] RE: Web Application Scanners Comparison

> I know some of you disagree -
> but maybe we can get some
> intelligent discourse around this?

maybe... :)

I personally don't think there is any only one way to test a web app, in
the same way that there isn't only one way to develop it.

Targeted testing is good, but may provide limited coverage for the time
expended.  Whilst crawling can be a bit of a blunderbuss, but can
pick-out obscure stuff that you'll not typically find by any other
approach, unless you spend a disproportionate amount of time manually
analysing every page in infinite detail.

The best balance is a little of column A and a little of column B (*),
which is where the value of a person driving the process beats a
point-and-click tool every time.

We regularly provide assessment projects to clients that have bought and
use one of the web scanners within their dev or QA teams, and when we
come back with a collection of show-stopper issues that weren't picked
up by the scanner, we have to take a deep breath and explain that
marketing material may not be entirely true.

The real problem here though is perception.  A web scanner isn't an
assessment; it may support one, but it isn't one of itself.  Buying one
and expecting it to find all the issues in every app is unrealistic.
Selling it as doing so is pants-on-fire material. :o


(*) tm Dave Ryan, all rights reserved.

CONFIDENTIALITY:  This e-mail and any files transmitted with it are
confidential and intended solely for the use of the recipient(s) only.
Any review, retransmission, dissemination or other use of, or taking
any action in reliance upon this information by persons or entities
other than the intended recipient(s) is prohibited.  If you have
received this e-mail in error please notify the sender immediately
and destroy the material whether stored on a computer or otherwise.
DISCLAIMER:  Any views or opinions presented within this e-mail are
solely those of the author and do not necessarily represent those
of Corsaire Limited, unless otherwise specifically stated.
Corsaire Limited, head office: Unit 2 Grosvenor Court, Hipley Street,
Old Woking, Surrey GU22 9LL. Telephone: +44 (0)1483-746700.
Registered in England No. 3338312. Registered office: Portland House,
Park Street, Bagshot, Surrey GU19 5PG. 

Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn

More information about the websecurity mailing list