Home page logo

pen-test logo Penetration Testing mailing list archives

Re: OWASP Top 10 penetration testing software?
From: martin.mngoma () gmail com
Date: Tue, 28 Feb 2012 20:53:35 +0000

I agree with you Robert

I also use different tools (manual + automated) and proxy hand in hand which always result to a close enough complete 
vulnerability scan.

Just bare in mind that never completely rely on scanners, as you still need that human factor to cross check and 
reference the findings.

Sent from my BlackBerry® wireless device

-----Original Message-----
From: Robert Wood <robertwood50 () gmail com>
Date: Tue, 28 Feb 2012 15:44:09 
To: <martin.mngoma () gmail com>
Cc: webcat<matthew.mckinzie () lewin com>; <listbounce () securityfocus com>; <pen-test () securityfocus com>
Subject: Re: OWASP Top 10 penetration testing software?

Hi, while the Owasp Top 10 is a good starting point for application
security testing, it is just that, a starting point. This list should
not be considered all inclusive and I encourage you to look for tools
with much more capabilities. Learning about the techniques involved in
web application testing and a simple proxy can often yield much more
in depth results.

That being said, these scanners are a good initial way to identify the
"easy to find" vulnerabilities that exist in your target application.
But don't stop there.

On Tue, Feb 28, 2012 at 3:15 PM,  <martin.mngoma () gmail com> wrote:

I am not sure about the "inexpensive" part as I don't know your budget but  the top 10 threats can be tested using 
Acunetix - vulnerability scanner - that's what I use.

There is only one short fall with this tool it doesn't support silverlight applications otherwise its very powerfull 
specially when you use it with the add on called Acusensor which eliminates false positives.

Please let me know if there is anything else or tools I may help you with.


Sent from my BlackBerry® wireless device

-----Original Message-----
From: webcat <matthew.mckinzie () lewin com>
Sender: listbounce () securityfocus com
Date: Tue, 28 Feb 2012 11:35:59
To: <pen-test () securityfocus com>
Subject: OWASP Top 10 penetration testing software?

Hi, for one of my websites, I have been required to use a web application
scanner that tests against the OWASP Top Ten threats. I'm looking for a
scanner that does this that is inexpensive or free.

Possible scanners I've found for this include the OWASP Zed Attach Proxy
Project, Sonar, and w3af, but none of these explicitly tests against the
OWASP Top Ten threats (at least not that I can tell).

Does anyone know of a scanner that does test against the OWASP Top Ten
threats? Thank you!
View this message in context: 
Sent from the Penetration Testing mailing list archive at Nabble.com.

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.


Robert Wood
Application Security Consultant
Cigital, Inc.
315-396-5029 (M)
Software Confidence, Achieved.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]