1. They are slow
2. They don’t have a sense of “weight” on the exploits
3. They miss half of the complex stuff

Couple of weeks ago we lost a bid based on the fact that the client tought we did everything automatic (Errr LoL! apparently they don’t read the blog, didn’t read my resume and didn’t reaaaaally understood some facts but then again who can blame the girl that was in charge?) this was hilarious but posed a very good question:

Why all scanners SUCK ARE BAD?

I’m not saying I’m way better than all of them, but given enough time I can find even more stuff than them on simple and way more on complex privilege escalation ones, I find myself writting my own tools for jobs and trying to make them as smart as I can, this is really a fun but slow job.

You would really think that since ALL webscanners have sites to try your scanner against they would make sure they would get most of the bugs even on those sites right? .. WROOOOOOOOONG most scanners found 50% of the bugs, God that makes you feel such a nice feeling, knowing you just got a very expensive web scanner to find .. HALF OF YOUR BUGS!

Anyway most of people know I usually get get software and products to break them up and then just either keep them (like my cisco routers) or give them back (like the Tipping Points … I never get to keep one! -_- ), this time I got the “pepsi challenge” from NT Objectives couple of weeks ago, and I was pleasantly surprised when I managed to hack into my intranet test sites before it, with a nice smile waited untill it finished saw the report, then passed the next 2 days trying to figure out 30% of the bugs it found.

I contacted them and chatted to them, I showed them my results and they showed me how to reproduce it raw and on HTML and I finally figured those out, I didn’t even know my sites had those bugs, I started o read up on their site and chat with their engineers and realized they have JavaScript Machines not to only parse the code but to actually run it, so they actually try different variations to bypass the javascript, try referer SQL injections, save web pages to actually find and differentiate from Blind SQL Injection AND (And this got me in love with the damn scanner) they actually find the COMPLETE injection, not just like “ok this breaks thank you for using our scanner now go make the exploit work yourself” kind of deal, noooo nooo noooo I mean this dudes find the entire SQL string you can just click on “verify” and you can check the exploit and get the URL to push it into your favorite injection tool if you want, figuring that out usually takes a while and is annoying (on this specific site the bug was inside a procedure so most of the scanners just broke the stuff but never really exploited and they found the ) and made the “foo’) or (1=1” to gather how bad or good was the injection.

I’m really not going to go into detail in the results and how good it is, all I can say is .. I went and bought it for myself, dropping all the other web scanners, don’t need them anymore at all, I still run everthing by hand anyway, but I feel confident than the low hanging fruit will be covered by this thing and hasn’t failed me yet.

I’ll leave you with the links so you can read up on the report, I found it very interesting!

Slashdot link covering the report
Original report
PDF of the report