OK, I covered Acunetix Web Vulnerability Scanner in a previous post and now it’s time to share a bit about another Web vulnerability scanner called N-Stalker Web Application Security Scanner 2009. I’ve used N-Stalker for a while dating back to when it was a free product nearly 10 years ago. Compared to the competition I must to admit that I haven’t been really impressed with the tool until now. Thiago Zaninotti – the product’s founder and developer – seems to have taken things up to the right level with the latest version.
The version of N-Stalker I’ve been using is the Enterprise Edition as shown in the following screenshot:
There’s a free edition of N-Stalker you should check out. They even offer a QA edition for use in the middle of the SDLC.
I like that N-Stalker includes policies for OWASP Top 10 and CWE Top 25 checks…it also has a web proxy (something you have to have for manual testing) as well as a HTTP brute force password cracker (although, like other vendors, it’s not really a “brute force” cracker in the traditional sense but rather a dictionary-based cracker). I’ve yet to find a true Web-centric brute-force password cracker other than Brutus which is getting some age on it and is no longer maintained.
Another really cool thing is that N-Stalker comes with a Web server load tester…something I’ve had a need for many times in the past for DoS testing but have not had access to at least in the context of a Web vulnerability scanner. Very cool.
In using it, a few things really stood out that I liked a lot:
There are some downsides:
All in all N-Stalker is a formidable tool especially for SMBs on a budget or if you’re just getting started down the Web security path. It’s also reasonably priced especially if cost is as important as brand name…Probably the best thing about it is the responsiveness I get from Thiago and his team. It’s almost immediate. I even found an issue that was causing an error when I exited the program that appears to be fixed. All in all, N-Stalker is definitely worth taking for a spin.
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”