A closer look at Acunetix Web Vulnerability Scanner 6.5

Web applications are accessible 24 hours a day, 7 days a week and control valuable data since they often have direct access to backend data such as customer databases. SSL and locked-down servers are futile against web application hacking. Any defense at network security level will provide no protection against web application attacks since they are launched on port 80 – which has to remain open. In addition, web applications are often tailor-made therefore tested less than off-the-shelf software and are more likely to have undiscovered vulnerabilities.

Acunetix Web Vulnerability Scanner (WVS) is an automated web application security testing tool that audits your web applications by checking for exploitable vulnerabilities (complete list.) Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive web site and web application penetration testing.

The installation process is short and simple. The only thing worth mentioning about it is that at one point you’re asked if you want to install a Firefox add-on that allows you to audit individual pages directly from the browser.

Upon starting the software, you will be greeted by a Scan Wizard window that will help you start using it through a step-by-step process. First, you must choose between 4 scan options (click on the screenshot to enlarge it):

We’ll deal with the most basic option – the scanning process is the same for every choice. To test the software first, Acunetix offers a few test sites – of course, if you’re planning to get down to business you won’t be needing them.

First, you have to choose the target:

Then you can choose the crawling options:

And the scan options:

The last step allows you to configure login details for password protected areas or HTML forms (if you have them, of course).

Upon starting the scan, we finally get to see the main screen (click on the screenshot to enlarge it):

Lets break it down. On the left there is a choice of tools, configuration settings and general information:

In the middle are the scan results, on the right is vulnerability and scan information, and on the bottom is an activity window that reports real-time what the scanner is doing, and you can browse through the already discovered issues.

Lets take a look at the format in which scan result information is given. Aside from the breakdown of discovered vulnerabilities according to severity, when you go to check each of them individually, you are given the following helpful information: vulnerability description, its impact, affected items, attack details, how to fix it, Web references (click on the screenshot to enlarge it):

Acunetix WVS doesn’t just let you see how your website is vulnerable. It also provides information and tools that allow you to test your web applications. Among others, you have at our disposal:

• The HTTP Editor – lets you see the headers responsible for the vulnerability and the HTML server response. Additionally, you can use the information, modify it and attack the server yourself to see how it behaves (click on the screenshot to enlarge it):

  

• The HTTP Sniffer – allows you to capture and modify HTTP traffic between an HTTP client and a web server, and lets you create custom traps for traffic
• The HTTP Fuzzer – allows testing for buffer overflows and input validation
• The Authentication Tester – lets you check the strength of your authentication methods by performing dictionary attacks on the login page.

Acunetix Web Vulnerability Scanner is an important tool for web developers. It’s very customizable and, therefore, lends itself to in-depth testing beautifully.

Version 6.5 brings:

• File upload forms vulnerability checks
• New Login Sequence recorder, supporting much more authentication forms and web technologies
• Session Auto Recognition module; during crawling, if the session is invalidated or logged out, the scanner will automatically replay login sequence without the need for manual intervention
• Actions drop down menu; for each selected node, the actions drop down menu is activated showing all possible functions to improve usability
• CAPTCHA and single sign on support
• New reporter supporting multi user scenario.