The Input Vector Support of Web Application Scanners

The current information is based on the results of the *2011/2012/2014/2016* benchmarks (excpet for entries marked as updated or new )

Note: The content in this page is *incomplete* since the research is still in progress - the various scanners might support additional vectors.

Last updated: 18/09/2016
Sorted in a descending order according to the scanner's number of supported input vectors and the scanner name .
Hint: hover over the marks and titles to get additional information on the various features.
Note: the information refers to the ability of the scanners to scan the input vector, not simply to interpret it.
Glossary
Unified List   Commercial Scanners   Free / Open Source Scanners


#
LogoVulnerability Scanner
C
O
U
N
T
G
E
T
P
O
S
T
C
O
O
K
I
E
H
E
A
D
E
R
S
E
C
R
E
T
P
N
a
m
e
X
M
L
X
m
l
A
T
T
X
m
l
T
A
G
J
S
O
N
.
N
e
t
E
N
C
A
M
F
J
a
v
a
S
E
R
.
N
e
t
S
E
R
W
C
F
W
C
F
-
B
i
n
W
e
b
S
o
c
k
D
W
R
C
u
s
t
o
m
D
I
R
F
I
L
E
P
a
t
h
N
e
s
t
X
M
L
N
e
s
t
J
S
O
N
J
s
o
n
P
N
a
m
e
M
u
l
t
i
p
a
r
t
G
W
T
O
D
a
t
a
I
D
O
D
a
t
a
F
i
l
t
1
Burp Suite Professional20
2
IBM AppScan17
3
Acunetix WVS16
4
AppSpider16
5
Netsparker16
6
Netsparker Cloud16
7
Tinfoil Security15
8
WebInspect13
9
Ammonite7
10
Syhunt Dynamic7
#
LogoVulnerability Scanner
C
O
U
N
T
G
E
T
P
O
S
T
C
O
O
K
I
E
H
E
A
D
E
R
S
E
C
R
E
T
P
N
a
m
e
X
M
L
X
m
l
A
T
T
X
m
l
T
A
G
J
S
O
N
.
N
e
t
E
N
C
A
M
F
J
a
v
a
S
E
R
.
N
e
t
S
E
R
W
C
F
W
C
F
-
B
i
n
W
e
b
S
o
c
k
D
W
R
C
u
s
t
o
m
D
I
R
F
I
L
E
P
a
t
h
N
e
s
t
X
M
L
N
e
s
t
J
S
O
N
J
s
o
n
P
N
a
m
e
M
u
l
t
i
p
a
r
t
G
W
T
O
D
a
t
a
I
D
O
D
a
t
a
F
i
l
t
11
N-Stalker6
12
QualysGuard WAS6
13
JSky (Commercial Edition)3
14
ParosPro3
15
WebCruiser Enterprise Edition3


Statistics
#
G
E
T
P
O
S
T
C
O
O
K
I
E
H
E
A
D
E
R
S
E
C
R
E
T
P
N
a
m
e
X
M
L
X
m
l
A
T
T
X
m
l
T
A
G
J
S
O
N
.
N
e
t
E
N
C
A
M
F
J
a
v
a
S
E
R
.
N
e
t
S
E
R
W
C
F
W
C
F
-
B
i
n
W
e
b
S
o
c
k
D
W
R
C
u
s
t
o
m
D
I
R
F
I
L
E
P
a
t
h
N
e
s
t
X
M
L
N
e
s
t
J
S
O
N
J
s
o
n
P
N
a
m
e
M
u
l
t
i
p
a
r
t
G
W
T
O
D
a
t
a
I
D
O
D
a
t
a
F
i
l
t
Scanners:15151312881083110400401138895527400



Glossary
AliasGeneral FeatureDescriptionReferences
GETHTTP Query String ParametersInput parameters sent in the URL1
POSTHTTP Body ParametersInput parameters sent in the HTTP body1
COOKIEHTTP Cookie ParametersInput parameters sent in the HTTP cookie1
HEADERHTTP HeadersHTTP request headers used by the application1
SECRETSecret HTTP ParametersNon-visible valid HTTP parameters (such as GET to POST, etc)
PNameHTTP Parameter NamesHTTP parameter names used by the application
XMLXML Element ContentThe content of XML elements1
XmlATTXML AttributesXML attributes1
XmlTAGXML TagsThe names of XML tags1
JSONJSON ParametersParameters sent in JSON format1
.NetENC.Net PostBack Encoded ParametersParameters sent after undergoing .net PostBack encoding1
AMFFlash Action Message FormatParameters sent in Flash AMF format1
JavaSERJava Serialized ObjectsParameters sent within Java serialized objects1
.NetSER.Net Serialized Objects / RemotingParameters sent within .Net serialized objects / remoting1
WCF.Net WCF ObjectsParameters sent in WCF requests1
WCF-Bin.Net Binary WCF ObjectsParameters sent in binary WCF requests1
WebSockHTML5 WebSocketsDirect Socket Browser-Server Communication1
DWRJava Direct Web RemotingParameters sent in DWR format1
CustomCustom Input VectorSupport for defining custom input vectors in the HTTP request
DIRDirectory Name Input VectorSupport for scanning the directory section in the HTTP URL
FILEFile Name Input VectorSupport for scanning the file name section (without extension) in the HTTP URL
PathHTTP Path Input VectorSupport for appending to and scanning the HTTP path
NestXMLNested XML In Parameter Input VectorSupport for scanning XML components which are nested in other parameters
NestJSONNested JSON In Parameter Input VectorSupport for scanning JSON components which are nested in other parameters
JsonPNameJSON Parameter Name Input VectorSupport for scanning JSON parameter names
MultipartMultipart Input VectorSupport for scanning Multipart values1
GWTGWT Input VectorSupport for scanning input sent in GWT (Google Web Toolkit) format1
ODataIDOData Id Input VectorSupport for scanning OData ID Values1
ODataFiltOData Filter Input VectorSupport for scanning OData Filter Values1



Copyright © 2010-2015 by Shay Chen. All rights reserved.
Click here to learn how this information may be published or reused.