Re: Web Application Scanners Comparison

[Derek Fountain <derekfountain () yahoo co uk>]

anantasec wrote:
> I've tested 13 web applications (some of them containing a lot of
> vulnerabilities), 3 demo applications provided by the vendors
> (testphp.acunetix.com, demo.testfire.net, zero.webappsecurity.com) and
> I've done some tests to verify Javascript execution capabilities.

You've labelled this piece of Javascript:

<script>
  // simple
  document.location = '/test_JS_1';
</script>

as "A valid vulnerability was reported" by each of the 3 contenders. 5 
points each.

I must be missing something. Where's the vulnerability?