WebInspect

Category: Vulnerability Scanners
Website: http://www.whitehatinc.com/spidynamics
Manufacturer: SPI Dynamics
Operating System: Windows

Description:
WebInspect is a vulnerability scanner that sets itself apart from other scanners by attacking the server at every level. You can specify a number of scans to be run including intrusive scans that should only be run internally to complete external scans that will uncover both known and unknown vulnerabilities on a running production server.

Strengths:
   · Easy to use
   · Fully automated mode
   · Interactive mode for more thorough assessment
   · Thorough reporting with quality recommendations.
   · Extremely extensive database of vulnerabilities

Weaknesses:
   · Won't run on Linux

Target:
Any exposed machine, IDS systems, firewalls, and web applications.

Mitigation/Recommendation:
The best mitigation is to keep your machines up to date with patches, use the best scanner you can afford to find, purchase a security audit from security professionals, improve you and your staff's security knowledge through training and experience, and be sure to fix any weaknesses apparent on your machines. We recommend Nessus as a good open-source free scanner. The good news is that if you use the scanner first, the hacker who uses a scanner to investigate your defenses will not find anything to attack and may move on to an easier target.

Price:
To Scan a LAN — $25,000 + $5,000 / year for maintenance
To Scan a Single Server — $6,000
To Scan a Single IP for 30 days — $2,500
To Scan any IP range twice per year — $20,000 for first user + $5,000 per aditional user for one year
contact vendor for latest information

Penetration (7):
This tool is a great candidate for system administrators locking down their site, however the licencing options are such that it would be difficult for a hacker to attack multiple systems with this scanner.

Simplicity (4-8):
Skilled to beginner Beginner, the canned scans are easy to run. Results are easy to interpret but in most cases would take moderate skill to create an exploit based on what is learned. Hacker will have to either find a canned exploit and figure out how to deploy to the target or will have to write there own

Damage Potential (6):
This tool comes with a number of known exploits that can cause a server to fail out of the box.