[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

In case you don't know what I'm talking about: http://www.acunetix.com/

It's basically a scanner which crawls the site and index's nearly every directory and after it has done that it scans for vulns on that site

Now a lot of people dislike people using tools and I was one of those members until recently. A lot of people think you aren't a "Hacker" if you use one of these tools. But think of it this way, if your looking for an SQLi on facebook for example. Are you going to go through every single link possible adding a ' to the end of every php?id= when you could get acunetix to run it for you and do it 100x quicker while also finding other vulns which you would have had absolutely no time to find.

However it starts crossing the line when you start using programs to do stuff for you, Personally it is fine with me if you know how to actually exploit them and use a scanner to find said exploits but if you start using something else to take over from that, Then it's over the top.

And 1 more thing to add onto this, Acunetix isn't even close to 100% accurate, It throws out so many Useless/False Positives it isn't even funny

For example I scanned a site which had apparently 1.3k DOM based XSS's and over 700 normal XSS's but when I personally had a look at them there was nothing

Some things that Acunetix chucks out that is pointless



🤩 Scott Thomas for pointing this out to me🤝

[St4rfox]

Acunetix is alright for quick n' dirty scanning.
The main issue with some of these scanners are just like you said false positives
And theyre noisy, branding themselves in the USER_AGENT field and spamming the httpd access.log file with a bunch of polluted parameters.

Some other options are: Netsparker (Less Noisy than Acunetix, but less accurate)
w3af (Open Source, More accuract than Acunetix/Netsparker)
Skipfish
Vanguard (This is made by blackhat academy, there's a public/private version, the public version doesnt crawl AJAX or generate the exploit payloads for you.)

[Vinnie]

Acunetix is alright for quick n' dirty scanning.
The main issue with some of these scanners are just like you said false positives
And theyre noisy, branding themselves in the USER_AGENT field and spamming the httpd access.log file with a bunch of polluted parameters.

Some other options are: Netsparker (Less Noisy than Acunetix, but less accurate)
w3af (Open Source, More accuract than Acunetix/Netsparker)
Skipfish
Vanguard (This is made by blackhat academy, there's a public/private version, the public version doesnt crawl AJAX or generate the exploit payloads for you.)

TLDR; Skid.

I think that's what Crushed was meant to say. 😁

[EliteTurk]

Looks good, might use it, nice post btw:)

[Upgraded]

You bought it?

I cracked it so that's why I use, because it was free.

I agree, it is a nice tool because I like to scan my website sometimes.

[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

You bought it?

I cracked it so that's why I use, because it was free.

I agree, it is a nice tool because I like to scan my website sometimes.

Only an idiot would actually buy something when there is a bay of pirates out there

[Upgraded]

Only an idiot would actually buy something when there is a bay of pirates out there

I like the way you think.

I hope you are using a trusted cracked edition, the one that got spread around the internet had a bank account stealing virus in it, I cracked mine myself.

Be careful. 🤝

[Flaaffy]

i love the way you think shadow, i have always told people when they give me the stereotypical SKID TOOLS HURR DURR, i simply said, you have to drag a rock up the hill you know you can drag the rock up te hill but it will take you twice as long, wouldnt you rather choose the farreri with the supermodel in the passanger seat?