-2

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. In the application we need to be in a certain point in the application to exploit certain vulnerabilities. I'm not sure anything like that is out there but I figure I would ask. Open-source would be preferable.

6
  • 2
    Are you looking for a tool that has this feature (tool recommendations are off-topic), or a "way" to re-test findings? What I do is simply re-run all tests and run a diff. Would that not work for you?
    – schroeder
    Commented Jan 7, 2016 at 4:24
  • A way to retest findings and keep track of them.
    – bdawg
    Commented Jan 7, 2016 at 13:01
  • Sounds like you're looking for a web regression test tracker and executor. That is likely off topic here. Commented Jan 8, 2016 at 5:00
  • Not off topi according to the rules. I am asking about a way to run a penetration test over and over again. What topics can I ask about here? IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to: web app hardening network security social engineering, including phishing risk management policies penetration testing security tools using cryptography incident response physically securing the office, datacentre, information assets etc.
    – bdawg
    Commented Jan 8, 2016 at 16:08
  • By looking for a tool, it's typically off-topic, as I mentioned. That's why I made my first comment. Tools come and go. If you can make it over to the DMZ, you can talk to folks directly.
    – schroeder
    Commented Jan 8, 2016 at 16:47

1 Answer 1

1

There are a few options... we are technically not supposed to provide vendor based recommendations in our answers, but... as an example:

HP Webinspect will perform web application vulnerability scans and allow one to restest/rescan/verify a fix or fixes were implemented without re-scanning the entire application.

It also integrates with HP Quality Center and IBM Rational ClearQuest for vulnerability tracking.

There are other vulnerability scanners from multiple vendors available, such as Acunetix, Nessus, Qualys, and BeyondTrust but I am unfamiliar with their offerings and they will have varying degrees of "web application" scanning support.

To me, it seems like you have two separate questions:

  • Can the vulnerability scanner retest/verify vulnerabilities?
    • What are my options for managing/tracking discovered vulnerabilities?

In regards to tracking, you might be able to leverage OWASP Dependency-Track

Dependency-Track has two main goals:

Document the use of third-party components across multiple applications and determine the use of vulnerable components across applications

Or possibly VScan

VScan was created as after a vulnerability assessment it can sometimes be difficult to track the implementation of a security improvement program, so this tool can help you measure your progress and simplify the process of fixing any problems found.

Or ThreadFix

ThreadFix is a software vulnerability aggregation and management system that reduces the time it takes to fix software vulnerabilities. ThreadFix imports the results from dynamic, static and manual testing to provide a centralized view of software security defects across development teams and applications.

4
  • Acunetix is not open source. acunetix.com/vulnerability-scanner
    – void_in
    Commented Jan 7, 2016 at 15:58
  • @void_in Thanks. I've updated my answer to reflect that.
    – k1DBLITZ
    Commented Jan 7, 2016 at 18:00
  • Neither is ThreadFix
    – bdawg
    Commented Jan 8, 2016 at 15:58
  • @bdawg There are both closed and open source versions of ThreadFix. The open source version is licensed under the MPL 2.0: github.com/denimgroup/threadfix
    – ZoogieZork
    Commented Jan 8, 2016 at 19:40

Not the answer you're looking for? Browse other questions tagged .