OWASP Phoenix Presentation 6-29-16 Black-Box Web Vulnerability Scanners
"Everything You've Ever Wanted to Know About Black-Box Web Vulnerability Scanners (But Were Afraid to Ask)"
Talk at OWASP Phoenix http://www.meetup.com/OWASP-Phoenix/
Black-Box web vulnerability scanners, such as Acunetix, AppScan, and WebInspect, attempt to automatically find vulnerabilities in web applications. These tools promise to bring pentesting skills to the average developer, and they are frequently used as part of the pen testing process.
However, despite their frequent usage, significant questions remain. How do these tools work? Are they effective at finding vulnerabilities? What research is being done to improve these tools? Can they handle modern client-side JavaScript web applications? In this talk, we'll cover all these questions and more!
Links to papers and tools discussed:
"Why Johnny Can't Pentest":
http://adamdoupe.com/publications/bla...
WackoPicko source code:
https://github.com/adamdoupe/WackoPicko
"Enemy of the state":
http://adamdoupe.com/publications/ene...
state-aware-crawler code:
https://github.com/adamdoupe/enemy-of...