2

We recently set up Nessus, but the annual cost is not cheap. Recently Google published SkipFish which appears to compete in the area of webapps.

As best I can tell, Nessus operates via a large database of known exploits. And, as best as I can tell, Skipfish automatically generates vulnerability tests. Has anyone done a comparison of the effectiveness of these two approaches yet?

2 Answers 2

2

Have you considered OpenVAS? It forked from Nessus when they closed source. Nessus and OpenVAS as opposed to SkipFish are less Web application focused and intended to cover a variety of daemons.

What are the requirements you're trying to meet?

1
  • openvas is a hard way to go, its lacking in docs and userbase
    – Tom
    Feb 1, 2012 at 4:19
2

Skipfish and Nessus have different objectives (although they share some checks).

  • skipfish is web vulnerability scanner: its mission is to find web apps vulnerabilities. On the lines of w3af and webscarab (but different).
  • Nessus is a vulnerability port scanner: its mission is to find vulnerabilities on open ports on a system. Besides, Nessus can also do compliance audits.

That said, Nessus also does some basic web vulnerability scanning that improves when used alongside nikto.

I don't know how you could compare them, knowing that they would output different kind of information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .