Title: [Article]-Interview: Ferruh Mavituna on Netsparker
Post by: don on January 07, 2010, 01:47:33 PM
Jason Haddix continues his fine work with another interview. If you have any questions for Mr. Mavituna, please feel free to ask them in this thread, and we'll do our best to get him to answer them personally.
Permanent link: [Article]-Interview: Ferruh Mavituna on Netsparker (http://www.ethicalhacker.net/content/view/290/2/)
Review by Jason Haddix
Today we showcase a new web application scanner called Netsparker (http://www.mavitunasecurity.com/), and believe us when we say we put this app through the ringer.
There's a big distinction between testing a tool against dummy apps in a lab and using it first hand against a large environment. Luckily for us we got to do both.
Over the course of a month we ran several engagements and specifically watched Netsparkerís performance compared to other tools we normally use in the assessment process (w3af (http://w3af.sourceforge.net/), Grendel Scan (http://www.grendel-scan.com/), Nikto (http://cirt.net/nikto2), Wikto (http://www.sensepost.com/research/wikto/), Websecurify (http://www.websecurify.com/), Paros (http://www.parosproxy.org/index.shtml), Burp (http://portswigger.net/suite/), etc). We have to say, we are very impressed. Netsparker not only caught vulnerabilities that other scanners missed but also had excellent remediation and a documentation section for most of its findings.
For injection it does a full-scale attack, testing every parameter it can spider (which it also does very well), and, although this lengthens the testing time, it also awarded us with some valuable injection findings. Netsparker is developed by Mavituna Security (http://www.mavitunasecurity.com/), and more specifically our guest, Ferruh Mavituna.
Title: Re: [Article]-Interview: Ferruh Mavituna on Netsparker
Post by: Ketchup on January 07, 2010, 11:38:37 PM
Jason, good work, as always. I am wouldn't mind trying the tool out. It's a bit pricey, but if it does what it says it could be worth a shot. Is there a trial version for Netsparker?