# A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions
## 4 Comparison of Selected Web Assessment Tools
### Comparative Analysis of Proprietary Tools  
* _Broken Access Control:_ In the survey process of proprietary scanners, it was observed that Acunetix detected most of the broken access control vulnerabilities, and HP WebInspect detected 67 CSS vulnerabilities. Results of NetSparker and AppScan tools were similar. Nessus detected 54 vulnerabilities. Detection of broken access control vulnerability by Acunetix is far better than other proprietary tools. * _Cryptographic Failures:_ The Acunetix scanner only detected this vulnerability; in other scanners, we're unable to detect broken authentication vulnerability. * _Injection:_ Acunetix detected this vulnerability with 145 scores, NetSparker detected 113 vulnerabilities, HP WebInspect detected 90 vulnerabilities, AppScan detected 88 data exposure vulnerabilities, and in this comparison, Nessus detected only 29 vulnerabilities. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Vulnerabilities** & **ZAP** & **Nikto** & **W3 af** & **Wapiti** & **Arachni** & **BurgSuite** \\ \hline Broken Access Control & 26 & 18 & 22 & 5 & 28 & 29 \\ Cryptographic Failures & 0 & 0 & 1 & 0 & 0 & 0 \\ Injection & 11 & 18 & 31 & 42 & 15 & 90 \\ Insecure Design & 11 & 0 & 0 & 1 & 1 & 1 \\ Security Misconfiguration & 8 & 4 & 11 & 18 & 17 & 12 \\ Vulnerable and Outdated Components & 0 & 10 & 13 & 2 & 27 & 27 \\ Identification and Authentication Failures & 743 & 545 & 411 & 223 & 180 & 179 \\ Software and Data Integrity Failures & 13 & 8 & 15 & 10 & 8 & 55 \\ Security Logging and Monitoring Failures & 4 & 6 & 8 & 0 & 13 & 6 \\ Server-Side Request Forgery & 36 & 43 & 26 & 39 & 25 & 52 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Total number of vulnerabilities classified and detected by open-source scanners. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Vulnerabilities** & **Acunetix** & **HP WebInspect** & **NetSparker** & **APPCCAN** & **Nessus** \\ \hline Broken Access Control & 115 & 67 & 60 & 58 & 54 \\ Cryptographic Failures & 3 & 0 & 0 & 0 & 0 \\ Injection & 145 & 90 & 113 & 88 & 29 \\ Insecure Design & 2 & 2 & 1 & 0 & 1 \\ Security Misconfiguration & 51 & 30 & 15 & 25 & 5 \\ Vulnerable and Outdated Components & 23 & 27 & 25 & 21 & 15 \\ Identification and Authentication Failures & 165 & 180 & 140 & 130 & 100 \\ Software and Data Integrity Failures & 133 & 52 & 115 & 95 & 49 \\ Security Logging and Monitoring Failures & 12 & 15 & 11 & 10 & 15 \\ Server-Side Request Forgery & 65 & 95 & 55 & 45 & 52 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Total number of vulnerabilities classified and detected by proprietary scanners. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Evaluated Scanner** & \multicolumn{2}{c}{**CSS**} & \multicolumn{2}{c}{**SQLI**} & \multirow{2}{*}{**Precision**} \\ \cline{2-4} \cline{6-6}  & **TP** & **FP** & **TP** & **FP** & \\ \hline Acunetix & 139 & 0 & 66 & 0 & 100\% \\ \hline IBM APPSCAN & 6 & 5 & 49 & 0 & 84\% \\ \hline Nessus & 200 & 21 & 43 & 5 & 90.88\% \\ \hline BurpSuite & 136 & 3 & 62 & 0 & 98.5\% \\ \hline Wapiti & 11 & 7 & 4 & 6 & 53\% \\ \hline Arachni & 136 & 5 & 60 & 0 & 81.32\% \\ \hline WebInspect & 8 & 7 & 11 & 17 & 44.1\% \\ \hline Nikto & 9 & 2 & 11 & 6 & 71.4\% \\ \hline Netsparker & 136 & 3 & 64 & 0 & 98.5\% \\ \hline W3 af & 81 & 3 & 19 & 3 & 94.3\% \\ \hline OWASP-ZAP & 136 & 0 & 63 & 0 & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Precision rate of evaluated scanners. * _Insecure Design:_ The detection score of this vulnerability is quite low; Acunetix and HP WebInspect detected only two vulnerabilities. NetSparker and Nessus detected only one vulnerability. AppScan could not find any malicious file inclusion vulnerability. * _Security Misconfiguration:_ Acunetix detected 51 vulnerabilities of this type, whereas HP WebInspect and AppScan detected 30 and 25 vulnerabilities. * _Vulnerable and Outdated Components:_ HP WebInspect detected more vulnerable and outdated components vulnerabilities than other proprietary tools with a 27 score.