A Semi Automated Approach to Assess Web Vulnerability Scanner Tools Effectiveness - Basso, Tania; Moraes, Regina L. O.; Jino, Mario (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2013: Anais do XIII Simpósio Brasileiro de Segurança da Informação e de Sistemas ComputacionaisDO - 10.5753/sbseg.2013.19537, 2013)
Nowadays, software products are developed with security vulnerabilities due to bad coding. Vulnerability scanner tools automatically detect security vulnerabilities in web applications; thus, trustworthiness on the results of these tools is essential and, sometimes, the evaluation of their results is done manually or even empirically. This work presents a semi automated approach, based on fault injection techniques, to assess the efficacy of these tools. Three scanner tools were assessed with the presence of realistic software faults responsible for security vulnerabilities in web applications. Results show that the approach is effective and has the advantage of predicting security vulnerabilities through the fault injection techniques.