# A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions
## 5 Our Contributions  
As discussed in Section 5, the quality of a web application scanner depends on three properties, Crawling, Fuzzing and Analyzing. First, crawling quality depends on the number of pages crawled by a scanner. Secondly, the quality of Fuzzing depends on the inputs that a fuzzer enters to find a certain vulnerability. During the development process of an indigenous scanner for detecting web application vulnerabilities, different open-source tools and technologies were used to develop a toolkit that can scan a given URL as a commercial scanner does. We focused on the crawling and detection process of web application scanning to enhance the performance of the developed toolkit. After surveying different commercial and open-source web application scanning tools, it was assessed that different tools have different features and characteristics. For example, some scanners have better crawling techniques and others have better detection techniques. After analyzing the performance and accuracy of surveyed scanner, it was discovered that after improving the crawling and fuzzing properties of a scanner, the performance of these scanners could be improved. Our first objective is to improve the crawler coverage of the scanner. An enhanced scanner coverage can be achieved by replacing the crawler component of a scanner with a better one. This technique might be helpful for some scanners but is not good for others, specifically if the integrated crawler works well. Therefore, an approach was chosen to integrate a better crawler component with other scanners. This newly integrated compiler provides additional URLs for a web application. To get the additional URLs of a web application, two approaches can be used: endpoint extraction from the source code of a web application and then using these detected URLs with an integrated crawler. Endpoint extraction can be conducted by searching the web application underscan's source code (including configuration files). Using this approach, a crawler can uncover hidden parameters of requests (e.g., debugging parameters). However, this approach is only feasible when the source code of the web application under test is available. If it is not available, then the second approach comes into play. This approach consists of using the best available crawler to obtain additional URLs. Our survey assessed that Arachni provides better crawling performance compared to other open-source crawlers such as ZAP, W3 af, and Wapiti. We used the second approach to develop the web application scanner toolkit. To check the crawling coverage, WIVET (Web Input Vector Extractor Teaser) version 4 was used, which is a benchmarking project specifically designed to assess crawling coverage. Table 7 compares crawling coverage results of tools with default and integrated crawlers. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Scanner**} & \multirow{2}{*}{**Raw Coverage**} & \multicolumn{2}{c}{**Coverage when Seeded with Arachni Crawled Results**} \\ \hline Arachni & 95\% & \\ \hline OWASP-ZAP & 68\% & 93.5\% \\ \hline W3 af & 22\% & 93.5\% \\ \hline Wapiti & 49\% & 93\% \\ \hline Nikto & 41\% & 93.5\% \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Site coverage rate before and after using Arachni Crawler. This table shows that raw crawling coverage of Arachni is already good, while ZAP, Wapiti, and W3 af find half of all resources. However, reliably performing authenticated scans is difficult due to some reasons. For example, it finds difficulties with various authentication methods, preventing logouts during scans, and re-authenticating sessions (e.g., when a web application with integrated protection mechanisms invalidates the authenticated session when scanned). Therefore, some scanners have difficulties with the authentication process.