Acunetix Web Vulnerability Scanner (WVS) Security Testing Tool (Hands on Review)

As the internet continues to become increasingly integral to business operations, so too does the rise in cyber attacks aimed at hacking websites and stealing valuable company information. As a result, the need to incorporate web vulnerability scanning into the broader testing process is now more important than ever.

The focus of this article is the Acunetix Web Vulnerability Scanner (WVS), a tool manufactured for the purpose of conducting security audits for web applications and websites. This solution offers various testing options, including SQL Injection, Cross-site scripting (XSS), and can detect other vulnerabilities aligned with the OWASP top 10 most critical security risks for web applications.

A Detailed Analysis of Acunetix Web Vulnerability Scanner

The Acunetix WVS is an automatic web application security testing solution engineered to mitigate the rising number of cyber attacks targeting web application layers. It performs website security audits by initiating a slew of attacks and generates comprehensive reports detailing the vulnerabilities found while offering solutions on how to fix them.

We’ll delve deeper into how Acunetix WVS operates in this review and outline some of its salient features.

Conducting an Online Vulnerability Scan

Before running a scan, I needed a susceptible site for testing. Acunetix offers its test sites, which provide an effective way of evaluating the product’s capabilities.

• http://testhtml5.vulnweb.com
• http://testphp.vulnweb.com
• http://testaspnet.vulnweb.com
• http://testasp.vulnweb.com

Starting a new scan is straightforward. Clicking on the “New Scan” button on the main toolbar launches the Scan Wizard, which will guide you through the customisation options for the scan.

For my initial scan, I selected the PHP test site listed above (http://testphp.vulnweb.com) as the target for Acunetix Web Vulnerability Scanner.

(Note: Click on any picture to enlarge it)

Next, I chose a Scanning Profile, a collection of vulnerability tests. Acunetix WVS offers pre-made Scanning Profiles as well as the option to create custom profiles based on specific needs.

As an example, if I’m focused on high-risk vulnerabilities, I can configure the scan to solely focus on these. The default Scanning Profile incorporates all the available tests but can be altered to meet specific requirements.

The Scan Settings provide control over the scan’s parameters. While not necessary for most users, I configured these settings to accommodate my HTTP proxy connection.

Acunetix WVS also provides additional options to enhance the scanning process, such as excluding certain pages from the scan and importing results from other tools like BurpSuite and Fiddler.

Acunetix WVS, as a black-box scanner, has the capability to scan any website or web application, irrespective of the programming languages or technologies used. It tests a site without any foreknowledge of how it functions, similar to a real-life hacker.

The Acunetix Web Vulnerability Scanner uses intelligent methods to optimise scans for specific technologies by fingerprinting web applications, which enables it to identify the technologies used and reduce scan time.

Scanning Password-Protected Sections of a Website

If a site includes a login page, creating a Login Sequence is necessary to guide the scanner on how to log into the app. Acunetix simplifies this process by recording the login steps, which are then replayed during the scan.

The Login Sequence Recorder enables manual creation of login sequences, which is beneficial for disentangling complex logins. Additionally, links can be restricted to stop the scanner from clicking on them while accessing the site.

A Session Pattern is required to show the scanner when it’s logged in or out. The Login Sequence Recorder detects this pattern automatically, but it’s customizable if needed.

Once the login sequence configuration is complete, it can be saved for future scans, eliminating the need for its repeated creation.

Other available scan options include selecting the User-Agent string and configuring scan limitations.

Website Vulnerability Scan Outcome

After finishing the scan and crawl, the Acunetix WVS presents a list of critical vulnerabilities detected on the test site.

Choosing a single vulnerability reveals details about the suspect input parameter and the varying potential attacks against it.

Clicking on different vulnerability variations provides a complete explanation, including impact and steps for remediation.

The detection of vulnerabilities like SQL Injection becomes more efficient if the Acunetix AcuSensor is installed because it identifies the file and the compromised line of code.

The alert includes comprehensive information, an extended explanation of the issue, guidance on fixing the vulnerability, and reference URLs for further details.

Running Tests Again Following Vulnerability Correction

One method to verify the success of a vulnerability fix is to rescan the site. However, Acunetix WVS provides a convenient Retest feature.

By right-clicking an alert and choosing Retest, the tests which discovered the vulnerability will be rerun, and any modifications will be displayed. If the vulnerability issue has been fixed, Acunetix marks it as resolved with a gray, strike-through font.

Web Vulnerability Scan Reports

The Acunetix Web Vulnerability Scanner’s Reporter function can generate easy-to-read reports. There’s an assortment of reporting options such as Affected Items, Executive Summary, Quick Report, and Compliance Reports meeting several standards, including OWASP Top 10, PCI, HIPPA and others.

The Developer Report, which is the most comprehensive report, can be customised to include essential information.

Technology Coverage

As a black-box scanner, Acunetix WVS can scan any website that is available over HTTP or HTTPS. It’s adept at finding vulnerabilities specific to several frameworks and technologies, including PHP, .NET, Ruby on Rails, popular Java frameworks, and content management systems like WordPress and their accompanying plugins.

DeepScan Engine to Manage Ajax and JavaScript

The Acunetix Web Vulnerability Scanner completely supports HTML5 and excels in identifying DOM-based XSS with a high degree of precision. Its DeepScan engine, incorporated with the crawler, executes and interacts with JavaScript and AJAX-driven applications.

For DOM-based XSS vulnerabilities, Acunetix WVS offers a stack trace showing how the XSS payload moves through the Document Object Model of the browser.

AcuSensor for Precise and Wide-ranging Scans

Acunetix AcuSensor, an optional component, offers Interactive Application Security Testing, which makes scans more precise and thorough by leveraging its backend system knowledge. AcuSensor can discover difficult-to-find vulnerabilities that a standard black-box scanner might struggle with, such as SQL Injection vulnerabilities in SQL queries.

AcuSensor identifies the compromised code line and can also report extra debug details, which makes it easier for developers to deal with significant security flaws.

AcuMonitor

AcuMonitor, included with Acunetix WVS, is an intermediary service that detects second-order vulnerabilities. These vulnerabilities may not provide a scanner response during testing and may include Blind XSS, XML External Entity Injection (XXE), Server-Side Request Forgery (SSRF), among others. AcuMonitor allows for these vulnerabilities’ automatic detection.

Acunetix Web Vulnerability Scanner Download

Acunetix provides a 14-day trial period for Acunetix WVS, which can be directly downloaded from their website. They also offer Acunetix OVS, an online version accessible for a 14-day trial period. To fully comprehend their range of features, it’s advisable to try these tools personally.

Final Remarks

More than the capabilities outlined here, the Acunetix Web Vulnerability Scanner also integrates manual penetration testing tools. These tools offer users the flexibility to run automatic scans and manually verify the results without having to switch between different pieces of software.

Acunetix WVS presents a plethora of features tailored for both security experts and software developers. Although this review offers a broad overview, note that many more advantageous features haven’t been covered here.

We would love to hear from you if you’ve used Acunetix or any other web vulnerability scanner. Please feel free to drop your experience or any questions in the comments section below!