4

I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow.

I am looking for an open source tool that will be faster and accurate in finding security holes.

Does anyone have any other experience they can convey in implementing security testing ?

1
  • Perform Manual Penetration Testing and use Kali Linux (it has everything) Dec 6, 2017 at 4:54

2 Answers 2

7

Welkome Ashok. I think that you need to be very careful with this.

Security testing is a field that you REALLY, REALLY need to know what you are testing for.

Security testing does not simply mean "point a tool at a site and get the results"

If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking for "Does anyone have any other experience they can convey in implementing security testing?" you really shouldn't be doing it. Sorry.

2
  • 1
    Agreed. OWASP is a good site for learning about security testing.
    – user246
    Dec 25, 2012 at 14:09
  • 3
    I'm inclined to agree. Specifically with regard to the question, for example, I wonder why the speed of the security test is so important, or in what ways is it too slow? Using a different tool in the same incorrect manner will yield the same results.
    – corsiKa
    Dec 25, 2012 at 19:22
7

Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;).

However there are still various options available to you.

One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the 'Oracle SQL Injection Enumeration' scan rule.

Another option is to perform regular scans using only the scan rules that you think are the most important, and doing a full scan less frequently.

Which rules are taking the most time? You can find this out in the zap.log file.

If you post to the ZAP user group then we'll do our best to help you with this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.