RE: FW: Tools comparison and evaluation question (AppScan)

["Joe White" <joe () navio com>]

Serg,

Here is a one stop shop for all of your layer 1-4 pen test needs.
Layers 5-7 are still somewhat of a topic of contention  :-)

http://www.remote-exploit.org/index.php/BackTrack

BackTrack is a bootable Linux CD solution that describes itself as the
next iteration of the Auditor bundle.  Just grab the ISO image and burn
to a CD locally.

I ultimately installed this distribution to the hard drive on a
dedicated system and have been very impressed with the bundle as a
whole.  Also, if you poke around the site a bit, there is some decent
docs on ramping up on the bundled tools if you are not that familiar
with them already.

Disclaimer:  I am in no way related/connected to the Backtrack or
Auditor distributions.  However, I have used them both and share this
information here from the perspective of a satisfied user and not
necessarily a promoter or advocate of the tools mentioned.

Hope this helps,

Joe

<<<>>>

-----Original Message-----
From: Serg B. [mailto:serg.belokamen () gmail com] 
Sent: Friday, February 17, 2006 7:45 AM
To: webappsec () securityfocus com
Subject: Re: FW: Tools comparison and evaluation question (AppScan)

Just to direct the topic a little bit:
Can anyone also recomed some good general pen-testing tools? So
something that is not specific to web application testing. Doesn't have
to be open source. Something a long the lines of Nessus.

   Thanks,
      Serg

> Hi All,
>
> I am currently looking at using/evaluating a tool called AppScan (by
> watchfire.com).
>
> So the question is in two parts and ASAP reply would be greatly
> appreciated.
>
> First:
> Without starting a flame war (hopefully) or marketing campaign
(another
> hopefully) can any one tell me abut their experience with the
software,
> what you find useful about it, what not, any annoyances, missing
> functionality, etc.
>
> Second:
> Can anyone recommend any simular type of software, preferably open
> source (although not at all essential), and describe its performance,
> usability and "usefulness" so to speak using AppScan as a reference
> point.
>
>    Thanks,
>        Serg
------------------------------------------------------------------------
> -
> This List Sponsored by: SpiDynamics
>
> ALERT: "How A Hacker Launches A Web Application Attack!" 
> Step-by-Step - SPI Dynamics White Paper
> Learn how to defend against Web Application Attacks with real-world 
> examples of recent hacking methods such as: SQL Injection, Cross Site 
> Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gR
> l
------------------------------------------------------------------------
> --
------------------------------------------------------------------------
-
> This List Sponsored by: SpiDynamics
>
> ALERT: "How A Hacker Launches A Web Application Attack!" 
> Step-by-Step - SPI Dynamics White Paper
> Learn how to defend against Web Application Attacks with real-world 
> examples of recent hacking methods such as: SQL Injection, Cross Site 
> Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gR
l
>
------------------------------------------------------------------------
--
>


------------------------------------------------------------------------
-
This List Sponsored by: SpiDynamics

ALERT: "How A Hacker Launches A Web Application Attack!" 
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world 
examples of recent hacking methods such as: SQL Injection, Cross Site 
Scripting and Parameter Manipulation

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gR
l
------------------------------------------------------------------------
--


-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics

ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------