Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. In the application we need to be in a certain point in the application to exploit certain vulnerabilities. I'm not sure anything like that is out there but I figure I would ask. Open-source would be preferable.
closed as off-topic by TildalWave, Bob Brown, Neil Smithline, Deer Hunter, WhiteWinterWolf Jan 8 '16 at 9:38
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Bob Brown, Deer Hunter, WhiteWinterWolf
There are a few options... we are technically not supposed to provide vendor based recommendations in our answers, but... as an example:
HP Webinspect will perform web application vulnerability scans and allow one to restest/rescan/verify a fix or fixes were implemented without re-scanning the entire application.
It also integrates with HP Quality Center and IBM Rational ClearQuest for vulnerability tracking.
There are other vulnerability scanners from multiple vendors available, such as Acunetix, Nessus, Qualys, and BeyondTrust but I am unfamiliar with their offerings and they will have varying degrees of "web application" scanning support.
To me, it seems like you have two separate questions:
- Can the vulnerability scanner retest/verify vulnerabilities?
- What are my options for managing/tracking discovered vulnerabilities?
In regards to tracking, you might be able to leverage OWASP Dependency-Track
Dependency-Track has two main goals:
Document the use of third-party components across multiple applications and determine the use of vulnerable components across applications
Or possibly VScan
VScan was created as after a vulnerability assessment it can sometimes be difficult to track the implementation of a security improvement program, so this tool can help you measure your progress and simplify the process of fixing any problems found.
ThreadFix is a software vulnerability aggregation and management system that reduces the time it takes to fix software vulnerabilities. ThreadFix imports the results from dynamic, static and manual testing to provide a centralized view of software security defects across development teams and applications.