Netsparker Web Application Security Scanner Room for Improvement

Ivan Biagi
Security Specialist at Alfa-A IT
The scanner itself should be improved because it is a little bit slow. CPU usage should be improved due to my PC's fan going mad. RAM usage also should be improved as well. The attacker part of the scanner should be more fluid and faster. There should be some option to tune up the scan, like throttling requests or using some WAF/IDS/IPS bypass technique. It needs more than what is currently in the Advanced Options. The passive analyzer for some vulnerabilities should be improved, as it doesn't get all vulnerabilities. It should also be more efficient. The scanner should also use some cool techniques to inject payloads, like replacing the entire body and Content-Type header (like for XML input). View full review »
reviewer1286490
Consultant Cyber Security at a tech services company with 51-200 employees
They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one. View full review »
Paolo Da Ros
Founding Partner at da ros e associati srl
The program uses technology that is different from application scanners. It's not an incremental solution. It could be a new product, but I'm not that knowledgeable to know which products are part of a suite. Netsparker doesn't provide the source code of the static application security testing. I would love to see a completion of the offering with statistical analysis. Every customer has its own nuance, so I don't think it's really an issue when it comes to the user interface. Every customer has something that they would like different because they're used to something different. In my opinion, there is not very much to mention besides changing as little as possible. Something that Microsoft often does, is to change things with every release and users don't like that. I would also see the price being at least 20% cheaper because the market is currently very crowded and there are many vendors and clients. A lower price will get more sales. View full review »
Find out what your peers are saying about Netsparker, Acunetix, PortSwigger and others in Application Security. Updated: January 2021.
456,249 professionals have used our research since 2012.
reviewer1286490
Consultant Cyber Security at a tech services company with 51-200 employees
With respect to the algorithm that Netsparker is running, they don't really provide the proof of concept up to the level that we need, here in the organization. Specifically, because the tool is running the scan and exploiting the read-only version, it doesn't prove to the customer that the exploit is genuine. We have to perform this manually, but it is difficult to prove to the concerned team, whether it is the development team, the remediation team, or the security team. Right now, they are missing the static application security part, especially web application security. If they can integrate a SaaS tool with their dynamic one then it would be really helpful. View full review »
AhmedS. Younis
Retail Services Senior Manager at e-finance
Improvement could be made in the area of production. Features like macro recording that I've used in other solutions would improve this product. Recording macro for complex applications, especially web applications where there is a complex web application for login or logout format. We could record the macro for login to make a dynamic scanning process, which makes it easier to scan methodology. We need to be able to record the macro. I think a feature like that would add a lot to the solution. View full review »
reviewer1188708
Senior Quality Control Manager at a insurance company with 51-200 employees
The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them. View full review »
Find out what your peers are saying about Netsparker, Acunetix, PortSwigger and others in Application Security. Updated: January 2021.
456,249 professionals have used our research since 2012.