RE: Environment for testing WebApp Security Scanners

["Brokken, Allen P." <BrokkenA () missouri edu>]

You might also consider looking at Foundstone's Hacme suite of sites as a compliment to site generator.  I've found 
that in testing scanners each methodology for building a site works different "muscles" in the scanner and having a 
diverse back drop to test against is important.

Also, it has been useful to have someone unfamiliar with the various sites and scanners being tested do the actual 
scanning.  I've found that having an intimate knowledge of the site and scanner can boost individual performance 
drastically and compared to the same person using different tools on a site they are unfamiliar with.

You might consider bringing in classmates who are technical, but unfamiliar with the tools / sites to do at least one 
round of your testing.  Most of the results/studies I've seen are done by highly trained professionals.  However, most 
purchasers of scanners have not risen to that level yet.  So a study along those lines would be very useful.


Allen Brokken

Information Security and Account Management - IAT Services - University of Missouri -brokkena () missouri edu - 
(573)884-8708

-----Original Message-----
From: René Palige [mailto:rwp () gmx de] 
Sent: Monday, August 07, 2006 3:33 PM
To: webappsec () securityfocus com
Subject: Environment for testing WebApp Security Scanners

Hi!

I?m currently working on my bachelor thesis which is about the development  
of a testsuite for different Web Application Security Scanners. My goal is  
to provide an environment which can be used as a basis for testing and  
evaluating the performance of the many tools already existing.  
Consequently the main part of my work will be to implement different types  
of vulnerabilites in more or less realistic scenarios and with different  
characteristics. At the moment I?m planning to use OWASPs WebGoat as some  
kind of groundwork.
My questions:
Which "features" would you consider to be necessary or useful in this  
context? And what basic requirements do you see which should be met? Would  
it be best to focus on "real-life scenarios"? Or rather to cover as many  
aspects of a special class of vulnerabilities as possible?

Thanks in advance,
R. Palige




-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. 
Download a free trial of AppScan today and see why more customers choose 
AppScan then any other solution. Try it today!
  
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web
application security assessment tools by both Gartner and IDC.
Download a free trial of AppScan today and see why more customers choose
AppScan then any other solution. Try it today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------