IBM Application Security Insider

The Ultimate Web App Security Scanner Comparison Published - AppScan Standard Leads the Pack

>>>> See the most recent results of the 2012 WAVSEP benchmark! <<<<

Shay Chen, an Information Security consultant and blogger, recently published the latest results of his ultra-thorough web application security scanner comparison. The survey, covered 60(!) different open source and commercial scanners, and summarized some of the most critical features and capabilities of each scanner, such as:

• Audit features and capabilities
  • Active vulnerability detection features
  • Complementary scanning features (passive analysis, known issues, etc.)
  • Usability, Coverage and Scan Initiation Features
  • Authentication, Scan Control and Connection Support Features
  • Advanced and Uncommon Features
• Accuracy benchmark (performed against WAVSEP)
• Cross-site scripting success & false positives rate
• SQL Injection success & false positive rate

Needless to say, AppScan Standard Edition led the pack in most aspects - especially around Audit Features and Scanning Capabilities, where no other scanner came even close:

Android Browser Cross-Application Scripting (CVE-2011-2357)

Recently we detected a security vulnerability in Android’s Browser which can be exploited by a non-privileged application in order to inject JavaScript code into the
context of any domain; therefore, this vulnerability has the same implications as global XSS, albeit from an installed application rather than another website.

Android 2.3.5 and 3.2 have been released, which incorporate a fix for this bug.  Patches are available for Android 2.2.* and will be released at a later date. Organizations can contact [email protected] for patch information.

The complete advisory can be found here.

Demo of the PoC:

 

We would like to thank the Android Security Team for the efficient and quick way in which they handled this security issue.