Web Application Security » w3af » Version 1.1 » Review

w3af Review
It's buggy and seems to try to do too many things, but having this on a USB drive has been valuable.

Valuable Features:

Having this on a USB drive saved me so many times, and has also proven an easy way to hammer the point home when doing a physical penetration test.

Improvements to My Organization:

We've been able to do lots of tests and have gotten lots of useful results.

Room for Improvement:

I found it buggy, but it probably takes an expert user who knows programming to work it properly.`

Use of Solution:

I've used it for one year.

Deployment Issues:

The best free software for pen testing web applications.

Stability Issues:

Unfortunately, once you get around the seemingly strict set of pre-requisites to install it, it is incredibly buggy. It seems to try to do too many things and be too fancy, but simply isn't useful.

Scalability Issues:

No issues encountered.

Customer Service:

It's good.

Technical Support:

It's good.

Previous Solutions:

I use many tools, but this one is always the first.

Initial Setup:

Installation is with some kind of wizard, but the tool is very useful and easy to use. Best choice as a good starting point.

Implementation Team:

I did it myself from their website.

ROI:

100%.

Other Advice:

I tried to install this on numerous systems and eventually, with help, I got it running. It needs far too many dependencies installed and there's too much messing about to be of much use. Once running, it's buggy and begs the question can it be relied upon? Even within Kali it reports website time-outs, yet Zap or Burp are able to do a successful scan. I wanted this to work so much and be able to use it as an additional check of my results but have now binned it.