Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It only takes a minute to sign up.
Sign up to join this community
I want to perform security testing on a website. I have already tested a website with Zed Attack Proxy (ZAP) but I found it quite slow.
I am looking for an open source tool that will be faster and accurate in finding security holes.
Does anyone have any other experience they can convey in implementing security testing ?
Welkome Ashok. I think that you need to be very careful with this.
Security testing is a field that you REALLY, REALLY need to know what you are testing for.
Security testing does not simply mean "point a tool at a site and get the results"
If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking for "Does anyone have any other experience they can convey in implementing security testing?" you really shouldn't be doing it. Sorry.
Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;).
However there are still various options available to you.
One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the 'Oracle SQL Injection Enumeration' scan rule.
Another option is to perform regular scans using only the scan rules that you think are the most important, and doing a full scan less frequently.
Which rules are taking the most time? You can find this out in the zap.log file.
If you post to the ZAP user group then we'll do our best to help you with this.
