1. Automatic security testing tools for web-based system
CS577b Individual Research
Shi-Xuan Zeng
04/23/2012

2. Outline Introduce security testing
Web application/system security testing
Web application/system security risks
Security testing tools comparison
Summary

3. What is security testing?
Providing evidence
Fulfilling requirements
Fundamental processes
Boundary values
Equivalence classes
Security classes
* Web Security Testing Cookbook (O’Reilly)

4. Web application security testing
Functional testing V.S. Security testing
Use variety tools manually and automatically
Simulate and stimulate activities
Goal
Produce repeatable and consistent tests
* Web Security Testing Cookbook (O’Reilly)

5. Web application security risks
* OWASP Top Ten Project (2010)

6. Top 10 Web Application Security Risks
* OWASP Top Ten Project (2010)

7. Security testing tools comparison 1
Ease of use
Information provided
Item tested
Traceability
OWASP WebScarab
Medium
Depends
Hard
Burp Suite Free
Nikto 2
Many
Wapiti
Excellent
Low
Skipfish
Med Hard
Good

8. Security testing tools comparison 2
Ease of use
Information provided
Item tested
Traceability
w3af
Easy
Good
Many
High
N-Stalker Security Scanner Free Edition
Very Easy
Acunetix WVS‏ Free Edition
Medium
Very limited
Low
Websecurify (browser-extension)
Few
Netsparker Community Edition(free)
Excellent

9. Summary Security testing provides evidence and fulfill requirements.
The goal is to produce repeatable and consistent tests.
Beware of top 10 web application security risks.
Choose free, easy used, and good traceability testing tools.
Suggest w3af and N-Stalker Security Scanner Free Edition.

10. Reference Web Security Testing Cookbook OWASP Top Ten Project
Paco Hope, Ben Walther; O’Reilly Media Inc.; Oct
OWASP Top Ten Project
10+ Free Web Application Security Testing Tools

11. Questions ?

12. Thank You!!