1

I've searched and read some articles about web application security scanners. I've found that almost all scanners at first crawl the application to find all pages (or states). And then after crawling completed, the scanner starts to test the application (fuzz testing for instance).

Isn't it possible (for some reasons) crawl and test pages simultaneously? For example find page A then do fuzz testing on it, after that crawl again and find page B and so on. Is it theoretically possible? Is it practical? If not, please explain why?

|improve this question
  • 2
    Fuzzing the pages could slow down or even crash the server, slowing down or preventing further crawling. It's better to crawl first and test later. – André Borie Sep 20 '15 at 19:16
  • Thanks. So it means that there is no way to do this? Even if using more simple and faster test? – user1422847 Sep 20 '15 at 19:40
  • 1
    Sure, it's possible. But usually, you want to gather as much information as you can before attempting an attack of any kind. – KnightOfNi Sep 20 '15 at 19:56
3

It is possible. WebInspect has had this feature since 2007 -- it may have been the first. Burp Suite Professional was also released that year with Spider and Scanner supporting runs simultaneously.

Some tools like Netsparker do crawl first, but in this case I have found that you can install Netsparker, configure it, have it crawl, attack, and export results faster than any other equivalent tool. I contend Netsparker will finish most apps over lunch when most other commercial scanners invovle wrangling that often goes on for days.

|improve this answer
  • Thanks. These tools would help me a lot. But unfortunately I couldn't find any documentation or papers about this feature. For example searching Burp Suite documentation didn't help. would you please help me with this? For instance is there any keyword that i should search to find papers? – user1422847 Sep 21 '15 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.