COMPARATIVE PERFORMANCE ANALYSIS OF WEB VULNERABILITY SCANNERS

Abstract

As the reliance on web-based services increases, attackers increasingly target web applications. Therefore, Web Vulnerability Scanners (WVS) are necessary to identify vulnerabilities prior to exploitation. This study conducted a comparative analysis regarding several commonly available automated WVS, namely: OWASP ZAP, Nessus, Nikto, and Burp Suite. Each tool was compared, and objective criteria were established to analyze detection when comparing relevant precision and recall rates. A controlled test case was produced to quantify the vulnerability detection capability of the scan tools which used intentionally vulnerable web applications such as DVWA and a live host, to ensure consistency and repeatability. The research showed that all the scans can detect known and common web-based vulnerabilities such as SQL injection and Cross site Scripting (XSS) but proved to be substantial variations in the level of efficacy of each of the tools across many metrics. Burp Suite had the highest accuracy of the detection rates, while OWASP ZAP provided a sufficient middle ground between usability and scan scope. Overall, this study provided security practitioners with an examination of the application and failings of commonly used WVS tools, allowing practitioners to make decisions based off informed knowledge of the tools used in vulnerability assessment.