Web application security scanner
A web application security scanner is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses. It performs a black-box test. Unlike source code scanners, web application scanners don't have access to the source code and therefore detect vulnerabilities by actually performing attacks.
Web applications have been highly popular since 2000 because they allow sophisticated scans, hunting out for vulnerabilities with minimal user interactions. Rather than just scanning static web pages, web application scanners nowadays are able to identify and detect vulnerabilities in dynamic web application points, hunt out parameters and subsequently perform related security analysis on them.
Customers benefit from the convenience of these applications, while tacitly taking on risk that private information stored in web applications will be compromised through hacker attacks, insider leaks etc. According to the Privacy Rights Clearinghouse, more than 18 million customer records have been compromised in 2012 due to insufficient security controls on corporate data and web applications.
A web application security scanner facilitates the automated review of a web application with the expressed purpose of discovering security vulnerabilities, and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, such as input/output validation: (e.g. cross-site scripting and SQL injection), specific application problems and server configuration mistakes.
|37%||Cross Site Scripting|
|5%||Denial of Service|
|4%||Cross Site Request Forgery|
|2%||Local File Inclusion|
|1%||Remote File Include|
Commercial and open-source scanners
Commercial scanners are a category of web-assessment tools which need to be bought with a specific price (usually quite high). Some scanners include some free features but most need to be bought for full access to the tool's power.
And open-source scanners are another class which are free in nature. They are the best of the category since their source code is open and the user gets to know what is happening unlike commercial scanners.
Security researcher Shay Chen has previously compiled a exhaustive list of both commercial and open-source web application security scanners. The list also highlights how each of the scanners performed during his benchmarking tests against the WAVSEP.
The WAVSEP platform is publicly available and can be used to evaluate the various aspects of web application scanners: technology support, performance, accuracy, coverage and result consistency.
Listing of Vulnerability Scanners
Here is a list of vulnerability Scanners currently available in the market. 
|w3af||w3af.org||Open Source (GPL v2.0)||Linux and Mac|
|TIDoS Framework||Infected Drake||Open Source (GPL v3.0)||Linux|
|Vega||Subgraph||Commercial / Free (Limited Capability)||Windows, Linux, Mac|
|Probe.ly||Probe.ly||Commercial / Free (Limited Capability)||SaaS|
|Nexpose||Rapid7||Commercial / Free (Limited Capability)||Windows, Linux|
|Grabber||Romain Gaucher||Open Source||Python 2.4, BeautifulSoup and PyXML|
|Acunetix WVS||Acunetix||Commercial / Free (Limited Capability)||Windows, SaaS|
|DefenseCode Web Security Scanner||DefenseCode||Commercial / Free||Windows|
Strengths and weaknesses
As with all testing tools, web application security scanners are not perfect and have strengths and weaknesses.
Strengths and advantages
These tools can detect vulnerabilities of the finalized release candidate versions prior to shipping. Scanners simulate a malicious user by attacking and probing, identifying results which are not part of the expected result set.
As a dynamic testing tool, web scanners are not language dependent. A web application scanner is able to scan engine-driven web applications. Attackers use the same tools, so if the tools can find a vulnerability, so can attackers.
Weaknesses and limitations
Free tools are usually not updated with the latest language-specific security flaws contained in recently updated languages; while this might be a minority of vulnerability the competent attackers are expected to try those attacks --- especially if they can learn which language the target website uses.
It is usually not possible to know how good a specific security scanner is if you do not have some security know-how yourself; and small business owners are hard to convince to run at least 5 free tools if the first found nothing.
Attackers could theoretically test their attacks against popular scanning tools in order to find holes in websites made by people who use security scanners excessively (there could, for example, be a typo away from what the free tools scan for), for purpose of making spam-sending botnets. As such at least all the free tools are weak against the competent and broad-targeting attackers.
Botnets and other attacks where the attackers can update the malware on the remaining unpatched computers are extremely hard to clear off some networks used by a large number of undisciplined users; such as some university networks who don't teach computers at all.
Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself. The penetration tester should look at the coverage of the web application or of its attack surface to know if the tool was configured correctly or was able to understand the web application.
It is really hard for a tool to find logical flaws such as the use of weak cryptographic functions and information leakage. Even for technical flaws, if the web application doesn't provide enough clues, the tool cannot catch them.
Furthermore, these tools don't test for social engineering holes that are plainly obvious to competent attackers.
A recent report found that the top application technologies overlooked by most Web application scanners includes JSON (such as jQuery), REST, and Google WebToolkit in AJAX applications, Flash Remoting (AMF) and HTML5, as well as mobile apps and Web Services using JSON and REST. XML-RPC and SOAP technologies used in Web services, and complex workflows such as shopping cart, and XSRF/CSRF tokens were also listed.
- Web Application Security Scanner Evaluation Criteria version 1.0, WASC, 2009
- "Chronology of Data Breaches". Privacy Rights Clearinghouse. 9 July 2012. Retrieved 9 July 2012.
- "2012 Trends Report: Application Security Risks". Cenzic, Inc. 11 March 2012. Retrieved 9 July 2012.
- "Verizon DBiR" (PDF). https://www.verizonenterprise.com. 2018.
|last1=in Authors list (help); External link in
- edgescan (2018). "2018 edgescan Vulnerability Stats report" (PDF). https://www.edgescan.com. External link in
- Comparison of Cloud & On-Premises Web Application Security Scanning Solutions. SecToolMarket.com Retrieved 2017-03-17
- WAVSEP Platform Retrieved 2017-03-17
- "Category:Vulnerability Scanning Tools - OWASP". www.owasp.org. Retrieved 2018-08-08.
- Web Application Scanners Challenged By Modern Web Technologies. SecurityWeek.Com (2012-10-25). Retrieved on 2014-06-10.
- Web Application Security Scanner Evaluation Criteria from the Web Application Security Consortium (WASC)
- Web Application Vulnerability Scanners, a wiki operated by the NIST
- Challenges faced by automated web application security assessment from Robert Auger
- The WASC security scanner list
- List of Web-based Application Scanners, Mosaic Security Research
- Identifying Web Applications from Fabian Mihailowitsch