This can result in information disclosure, revenue loss, damaged client relationships and more. Organisations that fail to protect their web applications are at risk of being targeted by attackers. Web applications are used by almost all organisations in all sectors for numerous purposes, including e-commerce, e-banking, e-learning, and social networking. Therefore, it is no surprise that there has also been a significant increase in the number of web applications, with an approximate total over 1.8 billion. The findings show that the black-box scanners overlook most vulnerabilities in almost all modes and some scanners missed all the vulnerabilities.Īccording to Internet Live Stats , there has been a significant increase in Internet users over the past decade, with approximately 4.7 billion users worldwide. We also tested the black-box scanners in four modes to identify their limitations.

The tested vulnerabilities are injection vulnerabilities, in particular, structured query language (SQLi) injection, not only SQL (NoSQL), and server-side template injection (SSTI). This study evaluates the detection accuracy of five black-box web application vulnerability scanners against one of the most modern and sophisticated insecure web applications, representing a real-life e-commerce. However, most tested applications are traditional (non-dynamic) and do not reflect current web. Most studies have evaluated these black-box scanners against various vulnerable web applications. To find web vulnerabilities before an attacker, security experts use black-box web application vulnerability scanners to check for security vulnerabilities in web applications.

More importantly, web applications have become increasingly vulnerable to malicious attack. Nearly all organisations use them for various purposes, such as e-commerce, e-banking, e-learning, and social networking. With the Internet’s meteoric rise in popularity and usage over the years, there has been a significant increase in the number of web applications.

Burp suite license key file