Re: Opinions on Burp Suite Web App Scanner

There is a project that automates, passive analysis made ​​by Burp.

 The Creator is the Wagner Elias, is an opensource project, done in Brazil.

http://wagnerelias.com/2011/10/18/webfight-automatizando-a-analise-passiva-de-aplicacoes-web/

@firebitsbr

2011/10/12 Arian J. Evans <[email protected]>

> It is the best product you will find for $300. It's probably the most
> widely used testing proxy today, and I highly recommend it for what it
> is. As for the crawler, that all depends on your websites. Go
> benchmark it on Wivet if you want synthetic metrics, but all that
> really matters are how a given crawler works on your own websites.
>
> For pure automation Netsparker is also cheap. Not useful for my needs,
> but consultancies that do limited scanner-jockey work on the DAST side
> of things get by with it.
>
> Also the SF pen-test list is dead for modern appsec PT talk. I
> recommend the OWASP or WASC lists. In fact, I bet this bounces from
> the SF PT list because the admins still can't figure out how to deal
> with gmail forwards on 40% of the SF lists. </amateur>
>
> I've CC'd the WASC list for you. The Denizens can chime in,
>
> ---
> Arian Evans
> Software Security Scanner Sophisticate
>
>
> On Wed, Oct 12, 2011 at 8:31 AM, Derrenbacker,  L. Jonathan
> <[email protected]> wrote:
> > I have budget for a web app vulnerability scanner, and I was wondering if
> anyone has opinions on the professional version Burp Suite with the scanner
> option.
> > Is the scanner any good? Accurate?
> >
> > This is the website if anyone doesn't know what it is:
> > http://portswigger.net/burp/scanner.html
> >
> >
> >
> > Thanks,
> > Jon
> >
> > ------------------------------------------------------------------------
> > This list is sponsored by: Information Assurance Certification Review
> Board
> >
> > Prove to peers and potential employers without a doubt that you can
> actually do a proper penetration test. IACRB CPT and CEPT certs require a
> full practical examination in order to become certified.
> >
> > http://www.iacertification.org
> > ------------------------------------------------------------------------
> >
> >
>
> _______________________________________________
> The Web Security Mailing List
>
> WebSecurity RSS Feed
> http://www.webappsec.org/rss/websecurity.rss
>
> Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
> WASC on Twitter
> http://twitter.com/wascupdates
>
> [email protected]
> http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
>

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org