Web application vulnerability scanners are automated
tools designed to scan web applications,
whether it be a server or a website or numerous
other applications that you might find on the web.
A lot of those web applications look for certain specific vulnerabilities
denoted with web servers and applications such as SQL Injection,
cross-site scripting, directory, transversal, even cross-site request for
there's different tools utilized to perform these different objectives.
NDO is a command-line web vulnerability scanner that excels
at searching for specific vulnerabilities including SQL Injection,
command Injection, cross-site, scripting and cross-site request.
Forgery.
These vulnerabilities are often dictated on websites or web applications
that could pose serious vulnerabilities with the exact applications utilizing.
So why is it command-line based? Well, that,
that entails a low resource involvement making it incredibly easy
to use without taking up a lot of system resources.
Another tool is called
Wazapp or
Owasp
ZED
attack proxy. This was designed with the web application security project or
a
to identify web application vulnerabilities within both
web applications as well as web sites
within it. We can see the detection of man in the middle attacks.
Other features include the ability to identify
vulnerabilities and then list them out.
Wazapp
is a great tool if you need that graphical user interface,
unlike NIC to where it gives a bare minimum,
it kind of tells you what's going on or defines the vulnerability.
Wazapp actually tells you or provides some
hints on how to actually fix it
so you can identify a vulnerability and then it goes through and it says, hey,
this is how I would fix it.
A
app does network management or I shouldn't say network management as much as
network scanning to identify different vulnerabilities
within the network as a whole.
It also offers a fuzzer something that
NTO doesn't, which provides us of throwing trash
at a web application or a website to see what happens.
Uh UA
Zap is a great graphical user interface tool and most students find
this to be a little bit easier to use than something like Nic
Arachni. On the other hand, is a ruby web based application scanner.
It emphasizes speed by conducting parallel scans
allowing Scalability without the performance loss.
So again,
another low resource tool that's utilized to find different items
and different vulnerabilities within our web applications and websites.
It searches for the same things that a lot of what NTO does looks for SQL Injection,
cross-site request, forgery code Injection, of course,
cross-site scripting among other tools.
The main thing that sets this one apart is that
it provides a little bit of training as it goes.
It may identify a vulnerability or a problem site.
And then it says, hey,
let's investigate this further and it kind of gives you
that that range of teachable moments when it goes through.
Lastly, we have something called burpsuite. Now, Burpsuite
is a very robust tool that can identify
different ports and it searches for SQL injections,
cross-site scripting.
It is enormous when it comes to its abilities,
we identify it as being a web application scanner, but it does so much more.
Uh it provides different aspects to actually identify man in the middle attacks.
And it helps you perform those man in the middle attacks.
If you're trying to pull something off,
it can identify traffic going both from the site and back to its repository.
Uh It just provides a great deal of not
only vulnerability scanning capabilities for websites and web applications,
but also the ability to actually exploit those web application vulnerabilities.