1

I want to automate web vulnerability scanning and generate a HTML/PDF report.
Are there any WVS that offer a scanning and reporting API? If so, what are some examples?

1 Answer 1

2

Your questions is best answered by the Web Application Vulnerability Scanner Evaluation Project (WAVSEP). Take a look at chapter "3.3 Support for Crucial SSDLC Integration Features".

Concerning automation, the following categories will be most interesting to you, depending on the type of automation you are aiming for:

Continuous Integration Support (BDD) - support for CLI/API/plugin-based scanning through external continues-integration / build-management software such as Jenkins. De-facto external support for scheduled scans.

Selenium Import/Integration (TDD) - importing crawling results or otherwise integrating with selenium scan scripts.

Periodic/Scheduled Scans - built-in scheduled scans (also possible through continues integration support through CLI/API/plugins)

Exporting results as HTML/PDF is a very common feature. This is not even explicitly mentioned in the benchmark data. I did a quick check for the commercial benchmarked tools and found the following:

  • AppSpider: HTML
  • Burp Suite: HTML, XML
  • Webinspect: PDF, HTML, RAW, RTF, TXT, XLS
  • AppScan: HTML, PDF
  • Acunetix: HTML, PDF
  • Netsparker: HTML, PDF
  • WebCruiser: no info found

Almost all of the commercial tools support HTML and/or PDF reports. It will be similar with the open source tools, but I leave this exercise to you.

0

Not the answer you're looking for? Browse other questions tagged .