Web application vulnerability scanners
Vulnerability scanners suffer from the common shortcomings of all scanners (scanners can only detect the signature of a known vulnerability; they cannot determine if the vulnerability can actually be exploited; there is a high incidence of false-positive reports). Furthermore, web vulnerability scanners cannot identify complex errors in business logic, and they do not accurately simulate the complex chained attacks used by hackers.
In an effort to increase reliability, most penetration testers use multiple tools to scan web services. When multiple tools report that a particular vulnerability may exist, this consensus will direct the tester to areas that may require manually verifying the findings.
Kali comes with an extensive number of vulnerability scanners for web services and provides a stable platform for installing new scanners and extending their capabilities. This allows penetration testers to increase the effectiveness of testing...
