The Authentication, Control and Connection Features of Web Application Scanners

The current information is based on the results of the *2011/2012/2014/2016* benchmarks (excpet for entries marked as updated

or new

)

Last updated: 18/09/2016
Sorted in an ascending order according to the scanner name .
Hint: hover over the marks and titles to get additional information on the various features.
Glossary

Unified List Commercial Scanners Free / Open Source Scanners

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

Acunetix WVS

Acunetix WVS Free Edition

Burp Suite Professional

crawlfish

Damn Small SQLi Scanner (DSSS)

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

JSky (Commercial Edition)

JSky Free Edition

LoverBoy

Mini MySqlat0r

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

Netsparker

Netsparker Cloud

Netsparker Community Edition

N-Stalker

N-Stalker 2009 Free Edition

N-Stalker 2012 Free Edition

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

safe3wvs (limited free edition)

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

SQID (SQL Injection Digger)

SQLiX

sqlmap

Syhunt Dynamic

Syhunt Mini (Sandcat Mini)

Tinfoil Security

Uber Web Security Scanner

Vega

VulnDetector

W3AF

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

Wapiti

WATOBO

Web Injection Scanner (WIS)

WebCruiser Enterprise Edition

WebCruiser Free Edition

WebInspect

WebScarab

WebSecurify (Opensource Version)

WSTool

Xcobra

Logo

Vulnerability Scanner

Custom
Cookie

Custom
Header

B
A
S
I
C

D
I
G
E
S
T

N
T
L
M

N
T
L
M
v
2

K
E
R
B
E
R
O
S

F
O
R
M

PROXY

GZIP

DEFLATE

SSL

CERT

Logout
Detection

Exclude
Logout

Exclude
URL

Exclude
Param

Statistics

#	Custom Cookie	Custom Header	B A S I C	D I G E S T	N T L M	N T L M v 2	K E R B E R O S	F O R M	PROXY	GZIP	DEFLATE	SSL	CERT	Logout Detection	Exclude Logout	Exclude URL	Exclude Param
Scanners:	42	30	39	27	32	13	8	34	44	30	22	44	26	21	36	39	32

Glossary

Alias	General Feature	Description	References
Custom Cookie	HTTP Cookie/s Customization	Support for customizing the cookie/s used in the test
Custom Header	HTTP Header/s Customization	Support for customizing the header/s used in the test
BASIC	Basic Authentication	Support for HTTP Basic Authentication	1
DIGEST	Digest Authentication	Support for HTTP Digest Authentication	1
NTLM	NTLM Authentication	Support for Authnetication via NTLM Credentials	1
NTLMv2	NTLMv2 Authentication	Support for Authenctication via NTLM Credentials	1
Kerberos	Kerberos Authentication	Support for Authenctication via Kerberos Protocol	1
FORM	FORM Based Authentication	FORM Based Authentication Support (Html Forms)	1
PROXY	Outgoing Proxy Support	Support for forwarding the communication via an Outgoing Proxy
GZIP	GZIP Compression Support	Support for decompressing/compressing GZIP communication	1
DEFLATE	Deflate Compression Support	Support for decompressing/compressing Deflate communication	1
SSL	SSL/TLS Encryption Support	Scan SSL/TLS Enhanced Servers	1
CERT	Client Side Certificate	Client Side Certificate Authentication Support
Logout Detection	Automated Logout Detection	Support for automatically detecting invalid sessions (logout/timeout)
Logout Exclusion	Logout URL Exclusion	Support for excluding the URL from the scan
URL Exclusion	URL Exclusion	Support for excluding URL groups from the scan
Param Exclusion	HTTP Parameter Exclusion	Support for excluding HTTP parameters from the scan