How Secure is Your Website?

Acunetix WVS is a tool that automates the process of Web application security
testing. It analyzes any website or Web application and scans them for
exploitable vulnerabilities such as Blind SQL Injection, Cross-Site Scripting,
and Directory Traversal, etc.

To check how secure a website is against vulnerabilities, WVS crawls through
the whole website, lists out all related pages and then scans each page. On the
pages where some input from user is required, it tries different input
combinations for detecting vulnerabilities. Its JavaScript  analyzer can be
used for testing applications made in Web 2.0 apps and Ajax. It also has a
reporting tool with which one can compare scan results and create professional
reports of scans performed. WVS comes with a HTTP Fuzzer that tests a range of
variables for detecting input validation and buffer overflow vulnerabilities.

How to use WVS?

To scan a website using the WVS tool, go to File menu, and under 'New'
select 'Web Site Scan' option, which will start the 'Scan' wizard. Under the
Scan type choose the 'Scan single website' option, specify the I.P Address or
URL of the website to scan, and click on 'Next'. After performing a basic scan
on the website for detecting basic details such as base path, Web server,
operating system and technologies used on the website, the wizard will ask you
to confirm the target. Then it will optimize the scan according to the detected
tecnologies and will ask whether you want to modify the general crawler behavior
of WVS. Once you define that, select the scanning profile and the scanning mode
to be used.

There are 15 scanning profiles customized for specific tests that come with
this utility and there are three scanning mode options: Quick, Heuristic, and
Extensive. Quick Scanning mode only tests for the first value of the parameters
defined, where as in Heuristic mode the scanner automatically

determines the parameters for which it should test all values and those for
which it should test first values only. The Extensive Scanning mode is the one
that scans the website for all parameters and with all possible combinations.

Acunetix WVS automatically detects and categorizes the detected vulnerabilities in four severity levels

Lastly, the wizard will ask you to review the scan details. Once you click on
'Finish,' it will start scanning your website and shows results in 'Scan
Results' window. Under Alerts, you can see detected vulnerabilities, and their
severity level i.e. high, mdium, low or informational. To view further details
click on the specific vulnerability, you will see a brief description of
vulnerability, its impact and details on how to fix it.