Comparing web application scanners

Summary: PortSwigger's Dafydd Stuttard responded to Larry Suto's web application scanner comparison, in which Burp Scanner trailed other products, arguing that Burp is built for hands-on penetration testing rather than the "point and shoot" mode Suto tested. Stuttard reran Burp against the same test applications in a couple of hours by ensuring it scanned every relevant request, and also noted that NTOSpider's lead came partly from counting each parameter in a request as a separate vulnerability.
What's compelling: Scanner rankings can turn on how findings are counted: consolidating NTOSpider's duplicated multi-parameter issues brought its numbers in line with other leading products, and Stuttard's own rerun led to engine changes in v1.3.06 that report an additional 16 vulnerabilities.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026