Acunetix Web Vulnerability Scanner Overview
Acunetix Web Vulnerability Scanner allows you to secure your website quickly and efficiently. It consists of the following components:
Screenshot - Acunetix Web Vulnerability Scanner
The Web Scanner launches an automatic security audit of a website. A website security scan typically consists of two phases:
- Crawling – Making use of Acunetix DeepScan, Acunetix Web Vulnerability Scanner automatically analyzes and crawls the website in order to build the site's structure. The crawling process enumerates all files and is vital to ensure that all the files of your website are scanned.
- Scanning – Acunetix Web Vulnerability Scanner launches a series of web vulnerability checks against each file in your web application – in effect, emulating a hacker. The results of a scan are displayed in the Alert Node tree and include comprehensive details of all the vulnerabilities found within the website.
AcuSensor Technology Agent
Acunetix AcuSensor Technology is a unique technology that allows you to identify more vulnerabilities than a traditional black box web security scanner, and is designed to further reduce false positives. Additionally, it also indicates the code where the vulnerability was found. This increased accuracy is achieved by combining black box scanning techniques with dynamic code analysis whilst the source code is being executed. For Acunetix AcuSensor to work, an agent must be installed on your website to enable communication between Acunetix Web Vulnerability Scanner and AcuSensor. Acunetix AcuSensor can be used with both PHP and .NET web applications.
Some vulnerabilities can only be detected using an intermediate service. The Acunetix AcuMonitor service allows Acunetix Web Vulnerability Scanner to detect such vulnerabilities. Depending on the vulnerability, AcuMonitor can either report the vulnerability immediately during a scan, or send a notification email directly to the user if the vulnerability is identified after the scan has finished. More information on the AcuMonitor Service can be found at http://www.acunetix.com/websitesecurity/acumonitor/
Screenshot - Port Scanning
The Port Scanner performs a port scan against the web server hosting the scanned website. Where open ports are found, Acunetix Web Vulnerability Scanner will perform network level security checks against the network service running on that port. These include DNS Open Recursion tests, badly configured proxy server tests, weak SNMP community strings, and many other network level security checks.
Screenshot - Target Finder
The Target Finder is a scanner that allows you to locate web servers (generally on ports 80, 443) within a given range of IP addresses. If a web server is found, the scanner will also display the response header of the server and the web server software. The port numbers to scan are configurable.
More information about the target finder can be found here: http://www.acunetix.com/blog/docs/target-finder/
Screenshot - Subdomain Scanner
Using various techniques, the Subdomain scanner allows fast and easy identification of active sub-domains of a top-level domain. The Subdomain Scanner can be configured to use the target’s DNS server or any other DNS server specified by the user.
More information about the Subdomain scanner can be found here: http://www.acunetix.com/blog/docs/subdomain-scanner/
Blind SQL Injector
Screenshot - Blind SQL Injector
Ideal for penetration testers, the Blind SQL injector is an automated database data extraction tool with which you can make manual tests to further analyze SQL injections reported during a scan. The tool makes use of Blind SQL Injection techniques to enumerate databases and tables, dump data and also read specific files on the file system of the web server if an exploitable SQL injection is discovered.
With the Blind SQL Injector tool you can also run manual tests to check for different variants of SQL injection. Using this tool, you can also run custom SQL ‘Select’ queries against the database.
More information about the blind SQL injector can be found here:
Screenshot - HTTP Editor
The HTTP Editor allows you to create, analyze, and edit client HTTP requests and server responses. It also contains an encoding and decoding tool to encode / decode text and URL’s to MD5 hashes, UTF-7 formats and many other formats.
You can start the HTTP Editor from the ‘Tools’ node within the Tools Explorer. The Top pane in the HTTP editor displays the HTTP request data and headers. The bottom pane displays the HTTP response headers data.
More information about the HTTP editor can be found here:
Screenshot - HTTP Sniffer
The HTTP Sniffer acts as a proxy and allows you to capture, examine and modify HTTP traffic between an HTTP client and a web server. You can also enable, add or edit traps to capture traffic before it is sent to the web server or back to the web client. This tool is useful to:
- Analyze how Session IDs are stored and how inputs are sent to the server.
- Alter any HTTP requests being sent back to the server before they get sent.
- Manual crawling; navigate through parts of the website which cannot be crawled automatically, and import the results into the scanner to include them in the automated scan.
For HTTP requests to pass through Acunetix Web Vulnerability Scanner, Acunetix Web Vulnerability Scanner must be configured as a proxy in your web browser.
Screenshot - HTTP Fuzzer
The HTTP Fuzzer enables you to launch a series of sophisticated fuzzing tests to audit the web application’s handling of invalid and unexpected random data. The HTTP Fuzzer also allows you to easily create input rules for further testing in Acunetix Web Vulnerability Scanner.
An example would be the following URL: http://testphp.acunetix.com/listproducts.php?cat=1
Using the HTTP Fuzzer you can create a rule that would automatically replace the last part of the URL ‘1’ with numbers between 1 and 999. Only valid results will be reported. This degree of automation allows you to quickly test the results of a 1000 queries without having to perform them one by one.
More information about the HTTP Fuzzer can be found here:
Screenshot - Authentication Tester
With the Authentication Tester you can perform a dictionary attack against login pages that use both HTTP (NTLM v1, NTLM v2, digest) or form based authentication. This tool uses two predefined text files (dictionaries) containing a list of common usernames and passwords. You can add your own combinations to these text files.
More information about the Authentication tester can be found here:
Web Services Scanner and Web Services Editor
Screenshot - Web Services Scanner
The Web Services Scanner allows you to launch automated vulnerability scans against WSDL based Web Services. Web Services are commonly used to exchange data and generally vulnerabilities in Web Services can easily be exploited in order to leak sensitive information.
The Web Services Editor allows you to import an online or local WSDL for custom editing and execution of various web service operations over different port types for an in-depth analysis of WSDL requests and responses. The editor also features syntax highlighting for all languages to easily edit SOAP headers and customize your own manual attacks.
Acunetix Web Vulnerability Scanner SDK
Screenshot – Web Vulnerability Scanner Scripting tool
You can download the scripting SDK from: http://www.acunetix.com/download/tools/Acunetix_SDK.zip
The Reporter allows you to generate reports of scan results in a printable format. Various report templates are available, including summary, detailed reports and compliance reporting. The Consultant Version of Acunetix Web Vulnerability Scanner allows customization of the generated report.
Screenshot - Typical Report including Chart of alerts
New in Acunetix Web Vulnerability Scanner Version 9
- Introduction of the Acunetix AcuMonitor service, which is used to identify specific vulnerabilities which require an intermediate server.
- Improved support in detecting and scanning smartphone / tablet friendly websites. When a mobile friendly site is scanned, the user is given the option to crawl and scan the site as a normal browser or as a smartphone browser.
- Full support for HTML5 websites.
- Detection of DOM-based XSS vulnerabilities.
- Detection of Blind XSS vulnerabilities (using AcuMonitor).
- Detection of Server Side Request Forgery (SSRF), XML External Entity (XXE), Mail Header Injection and Host Header-based vulnerabilities (using AcuMonitor).
New in Acunetix Web Vulnerability Scanner Version 9.5
- Detection of SQL Injection, XSS and other vulnerabilities in web applications implemented in Google Web Toolkit.
- Detection of vulnerabilities in JSON and XML data and HTTP HOST Headers.
- Alerts are now tagged with their CVE, CWE and CVSS.
- AcuSensor now supports .NET 4.5.
- Introduced support for CRUD (create, read, update and delete).
- New report for NIST 800-53 rev4.
Acunetix Blog and Support Page
Acunetix publishes a number of web security and Acunetix ‘how to’ technical documents on the Acunetix Web Application Security Blog; http://www.acunetix.com/blog.
You can also find a number of support related documents, such as FAQ’s in the Acunetix Web Vulnerability Scanner support page; http://www.acunetix.com/support.
Licensing Acunetix Web Vulnerability Scanner
Acunetix Web Vulnerability Scanner is available in 5 editions: Small Business, Enterprise, Enterprise x10 instances, Consultant and Consultant x10 instances. Ordering and pricing information can be found here:
Perpetual or Time-Based Licenses
Acunetix Web Vulnerability Scanner Enterprise and Consultant editions are sold as a 1 year subscription or perpetual license. The 1 year subscription license expires after 1 year from the date of download or activation. The perpetual license does not expire. The Small Business version is available as a perpetual license only.
If you purchase the perpetual license, you must buy a maintenance agreement to get free support and upgrades beyond the first month after purchase. The maintenance agreement entitles you to free version upgrades and support for the duration of the agreement.
Support and version upgrades are included in the price of the one-year license.
Enterprise Edition Unlimited Sites/Servers
The Enterprise edition license allows you to install one copy of Acunetix Web Vulnerability Scanner on one computer to scan an unlimited number of sites or servers. The sites or servers must be owned by yourself (or your company) and not by third parties. Acunetix Enterprise edition will leave a trail in the log files of the scanned server and scanning of third party sites is prohibited by the license agreement. Additional licenses are required for separate installs onto different workstations. This edition can also be upgraded to allow up to 10 simultaneous scans.
The Consultant edition license allows you to install one copy of Acunetix on one computer to scan an unlimited number of sites or servers including 3rd party sites, provided that you have obtained permission from the respective site owners. This is the correct edition to use if you are a consultant who provides web security testing services or are a hosting provider or ISP. The consultant edition also includes the capability of modifying the reports to include your own company logo. This edition does not leave any trail in the log files of the scanned server. Additional licenses are required for separate installs onto different workstations. This edition can also be upgraded to allow up to 10 simultaneous scans.
Limitations of the Trial
The trial of Acunetix Web Vulnerability Scanner – downloadable from the Acunetix website – is practically identical to the full version in functionality and features, but contains the following limitations:
- The Trial edition will expire after 15 days.When scanning your website, all the Web Alerts will be reported. However you will not be able to drill down and find where the vulnerability is found in your website.
- Reports cannot be generated. Scan results will not be stored in the Reports database.
- Full scans (including detailed information on the vulnerabilities discovered) can be made against the following Acunetix test web sites:
- The Scan Scheduler is not available.
If you decide to purchase Acunetix Web Vulnerability Scanner, you will need to uninstall the trial and install the purchased edition, which must be downloaded as a separate installer file. Download the installer file using the link provided by our sales team, and double-click to begin the setup. You will be prompted to remove the trial and install the full edition. All settings from the previously installed version will be retained.
Once the installation is complete, you will be prompted to enter the License key.