취약점 분석(Vulnerability Assessments) 솔루션 소개 : Web Application Scanner

○ Web Application Scanners List

1. Acunetix® Web Vulnerability Scanner

2. Casaba Watcher 1.5.1

3. Cenzic® Hailstorm® Enterprise Application Risk Controller

4. Cenzic Hailstorm Professional

5. eEye Retina Web

6. Grabber

7. Hacktics® Seeker®

8. HP WebInspect®

9. IBM/Rational® AppScan® Standard, Enterprise, and Express Editions

10. Mavutina Netsparker®

11. MAYFLOWER Chorizo! Intranet Edition

12. MileSCAN ParosPro Desktop Edition 1.9.12

13. MileSCAN ParosPro Server Edition 1.5.0

14. nCircle WebApp360

15. NGSSecure Domino Scan II

16. NGSSecure OraScan

17. Nikto2 2.1.4

18. NOSEC JSky 3.5.1

19. N-Stalker Web Application Security Scanner 2009

20. NT OBJECTives NTOSpider

21. PortSwigger Burp Suite Professional Edition Burp Scanner Component

22. Subgraph Vega

23. Syhunt Sandcat and Sandcat Pro

24. WATOBO 0.9.5

1. Acunetix® Web Vulnerability Scanner

Type	Web Application Scanner (with manual pen testing)
Target(s)
Format	Software
OS	Windows XP, Vista, 2000, 2003 Server, 2008 Server, 7 running IE 6+
Hardware	1GB RAM, 250MB disk
License	Commercial
SCAP Validated
Standards
Supplier	Acunetix Ltd. (Cyprus)
Information	http://www.acunetix.com/vulnerability-scanner/

* WVSFree Edition

2. Casaba Watcher 1.5.1

Type	Web Application Scanner
Target(s)	IIS
Format	Software
OS	Windows XP, Vista, 7, running Fiddler (http://www.fiddler2.com/fiddler2/)
Hardware
License	Freeware
SCAP Validated
Standards
Supplier	Casaba Security, LLC
Information	http://www.casaba.com/products/watcher/
	http://Websecuritytool.codeplex.com/

* Watcher has been released under Open Source license on Codeplex.

* Latest Version, Detailed Documentation can Download.

3. Cenzic® Hailstorm® Enterprise Application Risk Controller

Type	Web Application Scanner
Target(s)	IIS
Format	Software
OS	Windows 7 Pro, XP Professional SP3, Server 2008/2008 R2, Server 2003; running .NET Framework 3.5 SP1 and IIS 5.0+ with IIS lockdown tool 2.1
Hardware	Multi-core (2+) 400MHz+ Intel or Advanced Micro Devices (AMD) CPU, 4GB RAM; 50GB disk
License	Commercial
SCAP Validated
Standards	CWE
Supplier	Cenzic
Information	http://www.cenzic.com/products/cenzic-hailstormEntARC/

* Application Security for Cloud or Web.

4. Cenzic Hailstorm Professional

Type	Web Application Scanner
Target(s)	IIS
Format	Software
OS	Windows 7 Pro/XP Pro SP3
Hardware	Multi-core (2+) 400MHz+ Intel or AMD CPU, 3GB RAM, 20GB disk
License	Commercial
SCAP Validated
Standards	CWE
Supplier	Cenzic
Information	http://www.cenzic.com/products/cenzic-hailstormPro/

5. eEye Retina Web

Type	Web Application Scanner
Target(s)	Web sites, applications, services (SOAP/ WSDL only)
Format	Software
OS	Windows 2000 Pro/Server, XP, Server 2003, Vista (all 32- bit); must run .NET Framework 2.0/3.0, IE 6.0+
Hardware	1.4GHz Pentium IV or compatible, 1GB RAM (command line mode)/2GB RAM (graphical user interface mode); 500MB+ free disk space; 1024x768+ res. monitor; Internet access
License	Commercial
SCAP Validated
Standards
Supplier	eEye Digital Security®
Information	http://www.eeye.com/Products/Retina/Web-Security-Scanner.aspx

6. Grabber

Type	Web Application Scanner
Target(s)
Format	Software
OS	Executable: any Windows platform that supports Python (with BeautifulSoup and PyXML); Source code: presumably will run on any platform that supports Python
Hardware
License	Open Source
SCAP Validated
Standards
Supplier	Romain Gaucher
Information	http://rgaucher.info/beta/grabber/

7. Hacktics® Seeker®

Type	Web Application Scanner
Target(s)
Format	Software
OS
Hardware
License	Commercial
SCAP Validated
Standards
Supplier	Hacktics (Israel)
Information	http://www.hacktics.com
	http://www.hacktics.com/#details=;view=Products

8. HP WebInspect®

Type	Web Application Scanner
Target(s)
Format	Software
OS	Windows 7/Server 2008 R2 (32-/64-bit) (Recommended), XP Professional SP3/Server 2003 SP2 (32-bit), Vista SP2 (32-/64-bit), all running SQL Server Express Edition 2005 SP3/2008 SP2/2008 R2; SQL Server 2008 R2/2008 SP2/2005 SP4, .NET Framework 3.5 SP1, and IE 7.0 (8.0 recommended; Firefox supported for proxy setting only)
Hardware	1.5GHz single-core (2.5GHz+ dual-core recommended), 2GB RAM (4GB recommended), 10GB disk (100+GB recommended), 1024x768 res. Monitor (1280x1024 recommended); Internet connection (for updates)
License	Commercial
SCAP Validated
Standards
Supplier	HP/Fortify®
Information	https://www.fortify.com/products/web_inspect.html

9. IBM/Rational® AppScan® Standard, Enterprise, and Express Editions

Type	Web Application Scanner
Target(s)
Format	Software
OS	Windows XP Professional SP2/SP3, 2003 Standard/Enterprise SP1/SP2, Vista Business/Ultimate/Enterprise SP1/SP2, Server 2008 Standard/Enterprise SP1/ SP2, 2008 R2 Standard/Enterprise, 7 Professional/Enterprise/Ultimate (all must run in 32-bit mode), running IE 6+, .NET Framework 2.0+ (3.0 required for some options).
Hardware	2.4Ghz Pentium IV, 2GB RAM, 30GB disk, 100baseT NIC with TCP/IP configured
License	Commercial
SCAP Validated
Standards	CVE, CWE
Supplier	IBM
Information	http://www-01.ibm.com/software/awdtools/appscan/

10. Mavutina Netsparker®

Type	Web Application Scanner (with automated pen testing)
Target(s)
Format	Software
OS	Windows XP, 7, Vista, 2003/2008
Hardware
License	Commercial (one Open Source version)
SCAP Validated
Standards
Supplier	Mavuntina Security (UK)
Information	http://www.mavitunasecurity.com/netsparker/

* 15-Day Trial

11. MAYFLOWER Chorizo! Intranet Edition

Type	Web Application Scanner
Target(s)
Format	Appliance
OS	Include
Hardware	Include
License	Commercial (reduced-capability freeware available)
SCAP Validated
Standards
Supplier	MAYFLOWER GmbH (Germany)
Information	https://chorizo-scanner.com/

* 위 사이트의 보안접속은 인증서 문제로 접속이 안될 수도 있음

12. MileSCAN ParosPro Desktop Edition 1.9.12

Type	Web Application Scanner (with limited automated pen testing)
Target(s)	Web Server Applications
Format	Software
OS	Windows XP (32-bit), Vista, or 2000/SP2+
Hardware	Intel Pentium III+ CPU, 1GB RAM (2GB+ recommended), 100MB+ disk
License	Commercial (reduced-capability freeware available)
SCAP Validated
Standards
Supplier	MileSCAN Technologies Ltd. (Hong Kong)
Information	http://www.milescan.com/hk/index. php?option=com_content&view=article&id =98&Itemid=103

13. MileSCAN ParosPro Server Edition 1.5.0

Type	Web Application Scanner (with limited automated pen testing)
Target(s)	Web Server Applications
Format	Software
OS	Windows XP/Vista/Server 2003 (32-bit)
Hardware	Pentium IV+ CPU, 2GB RAM (3GB+ recommended), 2GB disk
License	Commercial
SCAP Validated
Standards
Supplier	MileSCAN Technologies Ltd. (Hong Kong)
Information	http://www.milescan.com/hk/index.php?option=com_content&view=article&id=99&Itemid=180

14. nCircle WebApp360

Type	Web Application Scanner
Target(s)
Format	Appliance
OS
Hardware
License	Commercial
SCAP Validated
Standards
Supplier	nCircle Network Security, Inc.
Information	http://www.ncircle.com/index.php?s=products_webapp360

15. NGSSecure Domino Scan II

Type	Web Application Scanner
Target(s)	Domino versions R6 to R8 inclusive
Format	Software
OS	Windows
Hardware
License	Commercial
SCAP Validated
Standards
Supplier	NGSSecure (UK)
Information	http://www.ngssecure.com/ngssecure/services/information-security-software/ngs-domino-scan-II.aspx

16. NGSSecure OraScan

Type	Web Application Scanner
Target(s)	Oracle Web Applications
Format	Software
OS	Windows
Hardware
License	Commercial
SCAP Validated
Standards
Supplier	NGSSecure (UK)
Information	http://www.ngssecure.com/ngssecure/services/information-security-software/ngs-orascan.aspx

17. Nikto2 2.1.4

Type	Web Application Scanner
Target(s)	HTTP/HTTPS-based Web server applications
Format	Software
OS	Windows (running ActiveState or Strawberry Perl); Mac OS X; Linux (Red Hat, Debian, Knoppix); Solaris. All with LibWhisker installed.
Hardware
License	Open Source
SCAP Validated
Standards
Supplier	CIRT.net (Chris Sullo and David Lodge)
Information	http://www.cirt.net/nikto2/

18. NOSEC JSky 3.5.1

Type	Web Application Scanner (with limited pen testing)
Target(s)	Web applications with backend SQL databases, including Oracle, SQL Server, MySQL, Informix, DB2, Access, SQLite®, Sybase, PostgreSQL
Format	Software
OS	Windows 2000/XP/2003/Vista/7
Hardware	1.5GHz+ Intel CPU, 1GB RAM, 2GB disk
License	Commercial
SCAP Validated
Standards
Supplier	NOSEC (Hong Kong)
Information	http://nosec.org/en/productservice/jsky/

19. N-Stalker Web Application Security Scanner 2009

Type	Web Application Scanner
Target(s)
Format	Software
OS	Windows 2000+
Hardware	1GB RAM, 500MB disk
License	Commercial (Freeware version also offered)
SCAP Validated
Standards	CWE
Supplier	N-Stalker
Information	http://nstalker.com/products

20. NT OBJECTives NTOSpider

Type	Web Application Scanner
Target(s)
Format	Software
OS
Hardware
License	Commercial
SCAP Validated
Standards	OVAL, CWE
Supplier	NT OBJECTives, Inc.
Information	http://www.ntobjectives.com/ntospider

21. PortSwigger Burp Suite Professional Edition Burp Scanner Component

Type	Web Application Scanner (with limited pen testing)
Target(s)
Format	Software
OS	Windows, Linux, Mac OS X; Java Virtual Machine (JVM/JRE)
Hardware
License	Commercial
SCAP Validated
Standards
Supplier	PortSwigger Ltd. (UK)
Information	http://portswigger.net/burp/scanner.html

22. Subgraph Vega

Type	Web Application Scanner (with manual pen testing)
Target(s)
Format	Software
OS
Hardware
License	Open Source
SCAP Validated
Standards
Supplier	Subgraph (Canada)
Information	http://subgraph.com/products.html

23. Syhunt Sandcat and Sandcat Pro

Type	Web Application Scanner
Target(s)	Web applications running on UNIX, Linux, or Windows
Format	Software
OS	Windows XP, 2003, 2008, Vista, 7
Hardware	128 MB RAM, 100 MB disk space
License	Commercial
SCAP Validated
Standards	CWE, CVE
Supplier	Syhunt Cyber-Security Co. (Brazil)
Information	http://www.syhunt.com/?n=Sandcat.Sandcat

24. WATOBO 0.9.5

Type	Web Application Scanner (with manual pen testing)
Target(s)
Format	Software
OS	Windows (XP, Server 2003/2008, Vista, 7); Linux (BackTrack 4, Ubuntu, OpenSuSE), Mac OS X
Hardware
License	Open source
SCAP Validated
Standards
Supplier	Andreas Schmidt/Siberas ITSicherheitsberatung Schmidt & Apelt (Germany)
Information	http://sourceforge.net/apps/mediawiki/watobo/index.php