Comparing web application scanners, part 2
Summary: A UCSB paper evaluated web application vulnerability scanners against a custom test application built with a wide variety of vulnerabilities and crawling challenges, which the authors describe as the largest such evaluation in terms of tools tested and vulnerability classes analyzed. Scanners were scored on their ability to find different vulnerability types in different scanning modes, and the results were presented alongside each scanner's price.
Bottom line: The paper's authors conclude that even the best automated crawlers fall far short of comprehensive coverage of modern applications, so a scanner's score and price tag can overstate how much of your application surface was actually tested.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026