3.2.2. Web Application Scanners

💡 First Principle: Web application scanners test what vulnerability scanners miss — the logic and behavior of the application itself, not just the underlying platform, which is where most modern breaches originate.

Traditional network vulnerability scanners test infrastructure: open ports, outdated OS, unpatched services. Web application scanners test the application layer: injection flaws, authentication weaknesses, authorization bypasses, business logic errors. A fully patched server can host an application with a critical SQL injection vulnerability that a network scanner would never find.

DAST (Dynamic Application Security Testing) tools test running applications by sending attack payloads and analyzing responses — the scanner acts like an attacker, not an auditor.

DAST and SAST find different things. SAST analyzes the application's code without running it, so it can flag flawed code paths early but cannot see runtime behavior. DAST sees only the running application, so it finds what exists at runtime: server and framework misconfiguration, missing security headers, authentication and authorization flaws, and problems that appear only in the deployed environment. A finding in one tool and not the other is therefore expected, not a contradiction; mature pipelines run both.

Burp Suite is the industry-standard web application testing platform. Two modes:

• Proxy mode — Intercepts browser traffic, allowing analysts to view and modify HTTP requests/responses manually. Essential for manual testing and understanding application behavior.
• Scanner mode (Burp Suite Pro) — Automated crawling and active scanning for injection, XSS, authentication issues, and more.
• Intruder — Automated payload testing for brute force, fuzzing, and parameter tampering
• Repeater — Replays and modifies individual requests for manual vulnerability verification

OWASP ZAP (Zed Attack Proxy) is the free, open-source alternative. Similar proxy/scanner architecture to Burp. Widely used for both manual testing and CI/CD pipeline integration (automated scanning of new builds).

Nikto is a fast, command-line web server scanner — checks for outdated software, dangerous HTTP methods, default credentials, and common misconfigurations. Less thorough than Burp/ZAP but quick for initial reconnaissance.

Arachni is an open-source web application security scanner framework built for automation and integration into testing pipelines.

⚠️ Exam Trap: Web application scanners generate significant false positives for business logic vulnerabilities — they can detect technical flaws (XSS, SQLi) but cannot understand whether a given application behavior violates business rules. Manual testing by a skilled tester is required for business logic assessment.

Reflection Question: A security team runs both Nessus and OWASP ZAP against a web application server. Nessus reports no critical findings. ZAP finds a reflected XSS and a SQL injection. Why does Nessus miss these, and what does this reveal about the complementary roles of network and web application scanners?