1. Comparison benchmark-APPSCAN
Take the paid APPSCAN missing scan tool as a benchmark, and compare the advantages and disadvantages of open source missing scan tools.
APPSCAN, installed on the windows operating system, can perform automated application security scanning and testing on web applications such as websites.
1.1 installation
- Download: The cracked version used, download from the network disk
Download from SkyDrive – APPSCAN
extraction code: e7yd
- installation:
Double-click the exe to install it. After the installation is complete, move the LicenseProvide.dll file to the installation path and replace the old LicenseProvide.dll file.
1.2 Use
Use tutorial:
APPSCAN installation tutorial
1.3 Results
Scan the X business system of the test environment according to the tutorial: The
scan results are as follows:
It can be seen that there are 2 high-risk items, 1 medium-risk item, and 4 low-risk items. Repair suggestions are also provided.
1.4 Advantages and disadvantages
Advantages: simple installation, multiple functions, clear results, comprehensive problems detected, problem analysis and modification suggestions, and PDF files can be exported.
Disadvantages: charges; only windows operating system, no linux and mac systems; more configuration items, more operation steps; single click, cannot be used by multiple people at the same time; unable to set timing tasks, slower scanning speed.
2. The open source leak scan tool arachni
Arachni is a multifunctional, modular, high-performance Ruby framework designed to help penetration testers and administrators evaluate the security of web applications. At the same time, Aracni is open source and free, can be installed on windows, linux and mac systems, and can export evaluation reports.
2.1 Installation
Official website download address: arachni download
Installation: Windows version can be installed directly by clicking the exe file
2.2 Use
After the installation is complete, enter the bin directory, double-click arachni_web.bat, and you will be prompted to monitor port 9292.
Enter IP:9292 in the browser (such as the local login http://localhost:9292) to enter the login interface
The default account secrets are as follows
After the login page, click scans to create a new one, enter the url, and click go to scan. You can also click scheduling below to set the scheduled scan task.
2.3 Results
Scanned out 0 high-risk, 2 medium-risk, 1 low-risk, and 5 prompt messages. Scanning has more problems than appscan, but most of them are less important information.
2.4 Advantages and disadvantages
Advantages: free, easy to obtain, windows, linux, mac versions are available, there is a web version, it can be used by multiple people at the same time after setting up on a server, the operation is simple, you can set timed tasks, and the scanning speed is faster.
Disadvantages: Fewer functions, the scan report is in English, cannot be exported as a PDF file, and there is no suggestion for modification. The formats that can be exported are as follows:
The generated html report is as follows:
3. Open source missing scan tool OWASP_ZAP
OWASP Zed Attack Agent (ZAP) is one of the most popular free security audit tools in the world, actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in web applications when developing and testing applications.
It can also be said: ZAP is a middleman agent. It allows you to view all the requests you make to the web application and all the responses you receive from them.
That is, it can be used by security experts, developers, functional testers, and even beginners in penetration testing. It is also an excellent tool for experienced testers for manual security testing.
3.1 Installation
Download link : OWASP_ZAP download
version: Windows, linux, mac, etc.
Installation: After the download is complete, double-click the exe file to install it.
3.2 Use
Mainly has the following important functions:
- Local agent
- Active scan
- Passive scanning
- Fuzzy
- Brute force
To perform a web miss scan, you can directly click Quick Start in the right window, enter the URL and click Attack.
3.3 Results
A total of 3 high risks and 5 low risks were swept out.
3.4 Advantages and disadvantages
Advantages: easy to obtain, open source and free, simple to deploy, powerful and rich, simple to operate, fast scanning, detailed results and solutions.
Disadvantages: English interface and results, only html, xml and json reports can be generated, not Generate a pdf report, and you cannot set a scheduled scan task.
4. Summary
The paid version APPSCAN is powerful, easy to install, comprehensive analysis report, and has specific suggestions for changes. There is a Chinese version. It can be purchased and used if it is not bad for money.
arachni is simple to operate, open source and free, reports are simple and generous, and has the function of setting regular scan tasks, which can be used for regular scans.
OWASP_ZAP has many functions and is powerful, open source and free, detailed results and solutions, and a wide range of applications.
In fact, many other missing scanning tools were found in the process, but many of them either have no specific interface, only command lines, or cannot export reports, or the functions are too simple, and the scan results are incomplete and the reports are not detailed. So I looked around and found the above two that are better for me and closer to my needs, for reference only.