Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for Vulnerabilities, but ALL-IN-ONE scanning (like Virustotal), which would include all free/trial tools available on internet?
closed as off-topic by Tobi Nary, Xander, AndrolGenhald, Matthew, forest Jan 9 at 3:13
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Tobi Nary, Xander, AndrolGenhald, Matthew, forest
To my knowledge, there is not a comprehensive, all in one solution that can effectively scan for different types of vulnerabilities on different types of projects. This is partially due to the fact that the type of data store required for that solution is immense, therefor many products have chosen to tackle a specific issue and excel at that verses being an inch deep across multiple vectors.
At a high level, I like the idea. I think it's probably a great niche for a business, but it would require that an appropriate team be assembled with enough knowledge around all of the fields you would like to support to be beneficial. Half way implemented features would not do this service any good and it would be dropped in favor of the specific tools that meet the needs of current processes.
There are some challenges I think you'll need to think about:
- The number of programming languages that need to be evaluated
- The number of potential CI/CD pipeline configurations
- The variation of OS systems and patching levels
- The limitations of cloud based security systems (AWS wont let you scan)
- Desktop application scanning
- Web Application Scanning
- Mobile Application Scanning
- Potential integration with multiple code repositories
Again, it's not a bad idea in theory. But taking it to production is a feat that I'm not sure anyone is really ready for at this point.