In my website I have an sql injection vulnerability.
But when I scan my website with Nessus under "Web app tests" there is no result on sql injection.
Why is this? What should I do to make this work?
closed as not a real question by AviD♦ Dec 19 '12 at 11:04
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.
Nessus is just a tool - it can do things you configure it to, but it is not intelligent in any way.
If you are detecting SQL as an authenticated user, Nessus will not be able to do this unless you allow it to authenticate to your application
If you are detecting it at a specific URL, you need to make sure Nessus is looking at that URL and that it is checking it for SQL.
Many things Nessus misses are down to misconfiguration or permissions, but even once you have set a tool up perfectly, they all have false positives and negatives - which incidentally is why any solely-tool based security scan should not be relied on without manual confirmation!