Web application vulnerability scanners are automated tools designed to scan web applications, whether
it be a server or a website, or numerous other applications that you might find on the web.
A lot of those web applications look for certain specific vulnerabilities, denoted with web servers
and applications such as SQL injection, cross-site scripting, directory traversal, even cross-site
request forgery.
There's different tools utilized to perform these different objectives.
Nikto is a command line web vulnerability scanner that excels at searching for specific vulnerabilities,
including SQL injection, command injection, cross-site scripting, and cross-site request forgery.
These vulnerabilities are often dictated on websites or web applications that could pose serious vulnerabilities
with the exact applications utilizing.
So why is it command line based?
Well, that that entails a low resource involvement, making it incredibly easy to use without taking
up a lot of system resources.
Another tool is called OWASp or OWASp Zed Attack Proxy.
This was designed with the Web Application Security Project, or OWASp to identify web application vulnerabilities
within both web applications as well as websites within it.
We can see the detection of man in the middle attacks.
Other features include the ability to identify vulnerabilities and then list them out.
Uh, OWASp is a great tool if you need that graphical user interface, unlike Nikto, where it gives
a bare minimum and kind of tells you what's going on or defines the vulnerability.
OWASp actually tells you or provides some, uh, hints on how to actually fix it so you can identify
a vulnerability.
And then it goes through and it says, hey, this is how I would fix it.
OWASp does, uh, network management or I shouldn't say network management as much as network scanning
to identify different vulnerabilities within the network as a whole.
It also offers a fuzzer something that Nikto doesn't, which provides us of throwing trash at a web
application or a website to see what happens.
Uh, OWASp is a great graphical user interface tool, and most students find this to be a little bit
easier to use than something like Nikto.
Arachne, on the other hand, is a Ruby web based application scanner.
It emphasizes speed by conducting parallel scans, allowing scalability without the performance loss.
So again, another low resource tool that's utilized to find different items and different vulnerabilities
within our web applications and websites.
It searches for the same things that a lot of what Nikto does.
It looks for SQL injection, cross-site request forgery, code injection, and of course, cross-site
scripting, among other tools.
The main thing that sets this one apart is that it provides a little bit of training as it goes.
It may identify a vulnerability or a problem site, and then it says, hey, let's investigate this
further.
And it kind of gives you that that range of teachable moments when it goes through.
Lastly, we have something called Burp Suite.
Now Burp Suite is a very robust tool that can identify different ports and it searches for SQL injections,
cross-site scripting.
It is enormous when it comes to its abilities.
We identify it as being a web application scanner, but it does so much more.
It provides different aspects to actually identify man in the middle attacks, and it helps you perform
those man in the middle attacks.
If you're trying to pull something off uh, it can identify traffic going both from the site and back
to its repository.
Uh, it just provides a great deal of not only vulnerability scanning capabilities for websites and
web applications, but also the ability to actually exploit those web application vulnerabilities.