Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 29 guests online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Commercial Web Application Test Suites
Ethical Hacker Community Forums
January 09, 2009, 02:43:45 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2009 - May 4 - 9. Boot Camps & an Ethical Hacking Conf. www.chicagocon.com
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Commercial Web Application Test Suites  (Read 2421 times)
0 Members and 1 Guest are viewing this topic.
Cutaway
Jr. Member
**
Offline Offline

Posts: 96


Cutaway


View Profile WWW
« on: December 19, 2006, 10:44:42 AM »

I know that most people here probably use the various open source web application testing tools such as

Paros Proxy - http://www.parosproxy.org/index.shtml
WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
Spike Proxy - http://www.immunitysec.com/resources-freesoftware.shtml
BurpSuite - http://portswigger.net/
Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project

But has anybody used any of the following commercial products to do automated testing and reporting within their environment?  If so, did you like it and was it worth it?

N-Stalker - http://www.nstalker.com/?src=winsecurity
Acunetix - http://www.acunetix.com/vulnerability-scanner/
NTOSpider - http://www.ntobjectives.com/products/ntospider.php
WebInspect - http://www.spidynamics.com/products/webinspect/index.html

Personally, from a testing standpoint I really like the ParosProxy but the last time I checked it does not have very good fuzzing capabilities.  Using some of the other free tools (like BurpSuite) fixes that but as I also have other issues to monitor and test being able to automate some of these tasks and increase my reporting output might actually be worth spending some money.

Thanks for your input.
Logged

Go forth and do good things,
Cutaway
chugh_a
Newbie
*
Offline Offline

Posts: 15


View Profile
« Reply #1 on: December 19, 2006, 09:34:47 PM »

AppScan (http://www.watchfire.com/default.aspx) is a nice tool which can be used to automate many testign activities.
Logged

CEH
Cutaway
Jr. Member
**
Offline Offline

Posts: 96


Cutaway


View Profile WWW
« Reply #2 on: December 20, 2006, 01:44:20 PM »

Yes, so far it appears that Watchfire (AppScan) and SPI Dynamics (WebInspect) are the big players in this field with their inclusion of development modules and review (whitebox testing).  But I am hoping to determine if anybody has any insight to whether or not the other products stand up to them in the field of automated assessment and pentesting (blackbox) and reporting output.

Thanks for the input.
Logged

Go forth and do good things,
Cutaway
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2007, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.042 seconds with 22 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
How many security events including conferences and training do you attend a year:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2009 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.