I'm currently in the process of trying to find a web application vulnerability management service. Currently, I have been unable to find out much behind these two technologies. I was curious if any of you have ever had experience with them here are few questions I have.

1. Do either test for header injections in particular cookies.

2. How is the blind sql testing?

3. DOM tests either have the ability to test these issues?

4. False positives, either produce high false positives?

any other information would be helpful in helping me make a decision!