# A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions
## 4 Comparison of Selected Web Assessment Tools
### Comparative Analysis of Open-Source Tools  
We assessed six well-known tools in an open-source web application security scanner tools: ZAP, Nikto, W3 af, Wapiti, Arachni, and BurpSuite. We set the same parameters for the assessment purpose as used in proprietary tools assessment. We assessed these six tools in the DVWA environment, and the generated results were matched with proprietary tools results.  
* _Broken Access Control:_ In the open-source tools category, BurpSuite detected 29 of these vulnerabilities, Arachni detected 28 vulnerabilities, and ZAP and W3 af detected 26 and 22 vulnerabilities, respectively. On the other hand, Wapiti detected only 5 of these types of vulnerabilities.
* _Cryptographic Failures:_ W3 af only detects this vulnerability in an open-source category. Other tools were unable to detect this vulnerability.
* _Injection:_ BupSuite detected this vulnerability with the highest score. W3 af detected 31 injection vulnerabilities. Nikto detected 18, Arachni detected 15, and ZAP detected 11 vulnerabilities.
* _Insecure Design:_ ZAP detected 11 insecure design vulnerabilities; Nikto and W3 af could not detect any vulnerability of this type. Wapiti and Arachni only detected one vulnerability.
* _Security Misconfiguration:_ Wapiti and Arachni's score was 18 and 17, respectively. BurpSuite detected 12 vulnerabilities, W3 af detected 11 vulnerabilities, and ZAP and Nikto detected 8 and 4 vulnerabilities.
* _Vulnerable and Outdated Components:_ BurpSuite and Arachni detected 27 vulnerabilities. W3 af detected 13, Nikto detected 10, and Wapiti detected only two vulnerabilities. ZAP could not detect any vulnerability.
* _Identification and Authentication Failures:_ This vulnerability was detected with high scores as compared to other vulnerabilities. ZAP detected 743 vulnerabilities, Nikto detected 545 vulnerabilities, W3 af score was 411, Wapiti detected 223 vulnerabilities, and Arachni detected 180 vulnerabilities.  
* _Software and Data Integrity Failures_: BurpSuite detected 55 vulnerabilities, and W3 af and ZAP detected 15 and 13 vulnerabilities. Arachi and Nikto detected eight vulnerabilities. Wapiti detected ten vulnerabilities. Comparatively, BurpSuite detected more data integrity vulnerabilities than other tools.
* _Security Logging and Monitoring Failures_: Arachi detected 13 vulnerabilities, and BurpSuite and Nikto detected six vulnerabilities. W3 af and ZAP detected 8 and 4 vulnerabilities, respectively. Wapiti could not detect any vulnerability of this type.
* _Server-Side Request Forgery_: BurpSuite detected 52 vulnerabilities of this type. Nikto detected 43, Wapiti detected 39, ZAP detected 36, W3 af detected 26, and Arachi detected 25 server-side request forgery vulnerabilities.  
As presented in Figure 1, Acunetix is ranked first, and NetSparker stood second in detecting high severity vulnerabilities. NetSparker stands second in detecting high severity vulnerabilities. In Figure 2, OWASP-ZAP has a high detection rate in the low severity vulnerabilities category. Open-source tools such as Burp Suite and Nikto depicted a high detection ratio of informational categories.  
A scanner could generate false-positive results in the black box evaluation of vulnerable web applications. In the context of black box testing, the scanners mostly rely on the information from service banners and signature matching checks, which leads to the false detection of vulnerabilities. Hence, it is important to verify the results manually by checking their validity and precision. Two approaches are used to validate web scanner obtained results. False Positive (FP) is referred to as a vulnerability that a scanner wrongly  
Figure 1: Detected Vulnerabilities on Proprietary Scanners.  
Figure 2: Detected vulnerabilities in open-source scanners.  
reported and a False Negative (FN), which is a vulnerability not detected or reported by a scanner. In this survey, we focused on false positive (FP) calculation.