Kevin Beaver's Security Blog

Another Web security scanner to check out

OK, I covered Acunetix Web Vulnerability Scanner in a previous post and now it’s time to share a bit about another Web vulnerability scanner called N-Stalker Web Application Security Scanner 2009. I’ve used N-Stalker for a while dating back to when it was a free product nearly 10 years ago. Compared to the competition I must to admit that I haven’t been really impressed with the tool until now. Thiago Zaninotti – the product’s founder and developer – seems to have taken things up to the right level with the latest version.

The version of N-Stalker I’ve been using is the Enterprise Edition as shown in the following screenshot:

N-Stalker 2009’s new interface is one of the best around

There’s a free edition of N-Stalker you should check out. They even offer a QA edition for use in the middle of the SDLC.

I like that N-Stalker includes policies for OWASP Top 10 and CWE Top 25 checks…it also has a web proxy (something you have to have for manual testing) as well as a HTTP brute force password cracker (although, like other vendors, it’s not really a “brute force” cracker in the traditional sense but rather a dictionary-based cracker). I’ve yet to find a true Web-centric brute-force password cracker other than Brutus which is getting some age on it and is no longer maintained.

Another really cool thing is that N-Stalker comes with a Web server load tester…something I’ve had a need for many times in the past for DoS testing but have not had access to at least in the context of a Web vulnerability scanner. Very cool.

In using it, a few things really stood out that I liked a lot:

1. You can change the scanner threads on the fly to throttle the requests without even having to pause the scan.
2. It has specific optimization settings for scanning generic HTTP devices such as routers (hosts with Web servers many people overlook in their security testing).
3. You can load a second instance of the program so you can run multiple scans at once…although it did seem to really slow things down.
4. It let’s you view not only the site tree (all of the files/folders in the site/app) but also an Ajax tree outlining all the Ajax related content on the site/app.

There are some downsides:

1. I’m not crazy about the signature-based approach the scanner uses. It seems to run every check in a serial fashion with multiple iterations through the same file structure. My experience has been that it can take a very long time to complete a scan…sometimes to the point where I just have to stop it altogether.
2. I couldn’t find a “full scan” policy option that would test everything – not just OWASP Top 10, buffer overflows, XSS, SQL injection, and so on.
3. There’s no real obvious way of determining at a glance how much time (or percentage) is left on the scan.
4. Program updates require you to step through the installation process and even (re)accept the license agreement.
5. The reports could be more intuitive.

All in all N-Stalker is a formidable tool especially for SMBs on a budget or if you’re just getting started down the Web security path. It’s also reasonably priced especially if cost is as important as brand name…Probably the best thing about it is the responsiveness I get from Thiago and his team. It’s almost immediate. I even found an issue that was causing an error when I exited the program that appears to be fixed. All in all, N-Stalker is definitely worth taking for a spin.