3.2.2. Web Application Scanners

💡 First Principle: Web application scanners test what vulnerability scanners miss — the logic and behavior of the application itself, not just the underlying platform, which is where most modern breaches originate.

Traditional network vulnerability scanners test infrastructure: open ports, outdated OS, unpatched services. Web application scanners test the application layer: injection flaws, authentication weaknesses, authorization bypasses, business logic errors. A fully patched server can host an application with a critical SQL injection vulnerability that a network scanner would never find.

DAST (Dynamic Application Security Testing) tools test running applications by sending attack payloads and analyzing responses — the scanner acts like an attacker, not an auditor.

Burp Suite is the industry-standard web application testing platform. Two modes:

• Proxy mode — Intercepts browser traffic, allowing analysts to view and modify HTTP requests/responses manually. Essential for manual testing and understanding application behavior.
• Scanner mode (Burp Suite Pro) — Automated crawling and active scanning for injection, XSS, authentication issues, and more.
• Intruder — Automated payload testing for brute force, fuzzing, and parameter tampering
• Repeater — Replays and modifies individual requests for manual vulnerability verification

OWASP ZAP (Zed Attack Proxy) is the free, open-source alternative. Similar proxy/scanner architecture to Burp. Widely used for both manual testing and CI/CD pipeline integration (automated scanning of new builds).

Nikto is a fast, command-line web server scanner — checks for outdated software, dangerous HTTP methods, default credentials, and common misconfigurations. Less thorough than Burp/ZAP but quick for initial reconnaissance.

Arachni is an open-source web application security scanner framework built for automation and integration into testing pipelines.

⚠️ Exam Trap: Web application scanners generate significant false positives for business logic vulnerabilities — they can detect technical flaws (XSS, SQLi) but cannot understand whether a given application behavior violates business rules. Manual testing by a skilled tester is required for business logic assessment.

Reflection Question: A security team runs both Nessus and OWASP ZAP against a web application server. Nessus reports no critical findings. ZAP finds a reflected XSS and a SQL injection. Why does Nessus miss these, and what does this reveal about the complementary roles of network and web application scanners?