2018-03-28T12:05:00Z

What needs improvement with Netsparker Web Application Security Scanner?

Julia Miller - PeerSpot reviewer
  • 0
  • 89
PeerSpot user
10

10 Answers

JoelGeorge - PeerSpot reviewer
Real User
Top 5
2022-04-25T09:34:32Z
Apr 25, 2022

Reporting should be improved. The reporting options should be made better for end-users. Currently, it is possible, but it's not the best. Being able to choose what I want to see in my reports rather than being given prefixed information would make my life easier. I had to depend on the API for getting the content that I wanted. If they could fix the reporting feature to make it more comprehensive and user-friendly, it would help a lot of end-users. Everything else was good about this product.

Search for a product comparison
PrashantPatil - PeerSpot reviewer
Consultant
Top 10
2022-04-25T09:34:19Z
Apr 25, 2022

I find that the scannings are not sufficiently updated.

Vishal Dhamke - PeerSpot reviewer
Real User
Top 10
2021-07-29T05:40:28Z
Jul 29, 2021

The license could be better. It would help if they could allow us to scan multiple URLs on the same license. It's a major hindrance that we are facing while scanning applications, and we have to be sure that the URLs are the same and not different so that we do not end up consuming another license for it. Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted. If you have a URL that you scanned once, like a website, you cannot retry that same license. If you are scanning the same website but in a different domain or different URL, you might end up paying for a second license. It would also be better if they provided proper support for multi-factor authentications. In the next release, I would like them to include good multi-factor authentication support.

SS
Consultant
2020-10-06T06:57:50Z
Oct 6, 2020

They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one.

SS
Consultant
2020-10-04T06:40:30Z
Oct 4, 2020

With respect to the algorithm that Netsparker is running, they don't really provide the proof of concept up to the level that we need, here in the organization. Specifically, because the tool is running the scan and exploiting the read-only version, it doesn't prove to the customer that the exploit is genuine. We have to perform this manually, but it is difficult to prove to the concerned team, whether it is the development team, the remediation team, or the security team. Right now, they are missing the static application security part, especially web application security. If they can integrate a SaaS tool with their dynamic one then it would be really helpful.

AY
Real User
2020-05-10T08:06:04Z
May 10, 2020

Improvement could be made in the area of production. Features like macro recording that I've used in other solutions would improve this product. Recording macro for complex applications, especially web applications where there is a complex web application for login or logout format. We could record the macro for login to make a dynamic scanning process, which makes it easier to scan methodology. We need to be able to record the macro. I think a feature like that would add a lot to the solution.

Find out what your peers are saying about Invicti, PortSwigger, HCLTech and others in Application Security Tools. Updated: March 2024.
765,234 professionals have used our research since 2012.
it_user1188708 - PeerSpot reviewer
Real User
2019-11-14T06:33:00Z
Nov 14, 2019

The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them.

PD
Real User
2019-08-21T06:36:00Z
Aug 21, 2019

The program uses technology that is different from application scanners. It's not an incremental solution. It could be a new product, but I'm not that knowledgeable to know which products are part of a suite. Netsparker doesn't provide the source code of the static application security testing. I would love to see a completion of the offering with statistical analysis. Every customer has its own nuance, so I don't think it's really an issue when it comes to the user interface. Every customer has something that they would like different because they're used to something different. In my opinion, there is not very much to mention besides changing as little as possible. Something that Microsoft often does, is to change things with every release and users don't like that. I would also see the price being at least 20% cheaper because the market is currently very crowded and there are many vendors and clients. A lower price will get more sales.

IB
Real User
2019-07-10T12:07:00Z
Jul 10, 2019

The scanner itself should be improved because it is a little bit slow. CPU usage should be improved due to my PC's fan going mad. RAM usage also should be improved as well. The attacker part of the scanner should be more fluid and faster. There should be some option to tune up the scan, like throttling requests or using some WAF/IDS/IPS bypass technique. It needs more than what is currently in the Advanced Options. The passive analyzer for some vulnerabilities should be improved, as it doesn't get all vulnerabilities. It should also be more efficient. The scanner should also use some cool techniques to inject payloads, like replacing the entire body and Content-Type header (like for XML input).

NY
Real User
2018-03-28T12:05:00Z
Mar 28, 2018

Perhaps the custom attack preparation screen might be improved. Also, they can implement mobile penetration testing support for manual and automated tests.

Application Security Tools
Application security is a significant challenge for software engineers, as well as for security and DevOps professionals. It comprises the measures taken to improve the security of online services and websites against malicious attacks by finding, repairing, and preventing security weaknesses and vulnerabilities.
Download Application Security Tools ReportRead more

Related Q&As