On 12 October 2011 16:31, Derrenbacker, L. Jonathan
<JDerrenbacker (at) kshgs (dot) com [email concealed]> wrote:
> I have budget for a web app vulnerability scanner, and I was wondering if anyone has opinions on the professional version Burp Suite with the scanner option.
> Is the scanner any good? Accurate?
>
> This is the website if anyone doesn't know what it is:
> http://portswigger.net/burp/scanner.html

It is a brilliant tool, well worth the cash compared to the much more
expensive alternatives. The built in scanner is fairly accurate, has a
few problems with LDAP injection false positives but tends to find XSS
and SQLi pretty well.

Robin

>
>
>
> Thanks,
> Jon
>
> ------------------------------------------------------------------------

> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------

>
>

------------------------------------------------------------------------

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[ reply ]