RE: Re; Comparison report on web app security scanners

[<Holger.Peine () iese fraunhofer de>]

> My German is not that great. Can I assume the basic summary from 
> page 149 is as follows?
>
> Sanctum / Watchfire could only find 1 in 5 issues or 20%
> WebInspect about 6%

Those are the numbers for one of the two applications (Webgoat).
On the other application (SNM), WebInspect performed clearly better,
and AppScan somewhat better, too.

> Accuntix was so bad it wasn't worth reporting results

That was true in any case.

> What I didnt see was a comparison of types of issues ie bugs and 
> flaws? I imagine they are basically all at 0% on flaws but ....

Each and every finding of AppScan and WebInspect on both applications
is listed in detail, covering many pages. However, of course you will
have a hard time with all being in German...

Regarding bugs vs. flaws: The tools found (apart from many false
positive
findings) things like XSS, XST, lacking exception handling in parameter
processing, directory listing, unencrypted login requests - all of them
rather implementation bugs than design flaws, I should say (with the 
arguable exception of the unencrypted login). It's hard to imagine a 
tool finding design flaws - can you give a good, feasible example?

Hope to have helped,
Holger Peine

-- 
Dr. Holger Peine, Security and Safety
Fraunhofer IESE, Fraunhofer-Platz 1, 67663 Kaiserslautern, Germany
Phone +49-631-6800-2134, Fax -1299 (shared)
PGP key via http://pgp.mit.edu ; fingerprint is 1BFA 30CB E3ED BA99 E7AE
2BBB C126 A592 48EA F9F8

-------------------------------------------------------------------------
Sponsored by: Watchfire

Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase in
the development of any web application. What methodology should be
followed? What tools can accelerate the assessment process?
Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007t9h
--------------------------------------------------------------------------