Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow.

I am looking for an open source tool that will be faster and accurate in finding security holes.

Does anyone have any other experience they can convey in implementing security testing ?

share|improve this question
add comment

2 Answers 2

Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;).

However there are still various options available to you.

One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the 'Oracle SQL Injection Enumeration' scan rule.

Another option is to perform regular scans using only the scan rules that you think are the most important, and doing a full scan less frequently.

Which rules are taking the most time? You can find this out in the zap.log file.

If you post to the ZAP user group then we'll do our best to help you with this.

share|improve this answer
add comment

Welkome Ashok. I think that you need to be very careful with this.

Security testing is a field that you REALLY, REALLY need to know what you are testing for.

Security testing does not simply mean "point a tool at a site and get the results"

If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking for "Does anyone have any other experience they can convey in implementing security testing?" you really shouldn't be doing it. Sorry.

share|improve this answer
1  
Agreed. OWASP is a good site for learning about security testing. –  user246 Dec 25 '12 at 14:09
2  
I'm inclined to agree. Specifically with regard to the question, for example, I wonder why the speed of the security test is so important, or in what ways is it too slow? Using a different tool in the same incorrect manner will yield the same results. –  corsiKa Dec 25 '12 at 19:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.