Network Scanners
From SAMATE
General-purpose network scanners look for [1] known vulnerabilities in:
- operating systems
- applications
- web servers
- mobile code
- network devices
- network protocols
Some Instances
DISCLAIMER: Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor does it imply that the products are necessarily the best available for the purpose.
By selecting almost any of these links, you will be leaving NIST webspace. We provide these links because they may have information of interest to you. No inferences should be drawn because some sites are referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the assertions presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites.
By selecting almost any of these links, you will be leaving NIST webspace. We provide these links because they may have information of interest to you. No inferences should be drawn because some sites are referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the assertions presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites.
Please contact us if you think something should be included. If it has all the characteristics of the tool, techniques, etc., we will be happy to add it. You can contact us at 
.
- ISS - Internet Security Systems includes a network-based scanner: it is installed in a single location on the network and assesses the vulnerability of communications services, operating systems, key applications, and routers.
- Nessus is a freeware network scanner, available for Linux and other Unix-like OS.
- NT OBJECTives offers NTOSpider, a web application vulnerability scanner. (24 May 2005)
- SPI Dynamics offers WebInspect Enterprise Edition, a network security scanner, capable of scanning web services and applications for vulnerabilities and identifying those vulnerabilities through techniques including SQL injection, "fuzzing" and cookie manipulation. (21 Dec 2004)
- Qualys has a suite of tools that provide both network as well as internal system scans of security vulnerabilities. Tools are available for both the enterprise as well as small business.
[1] DISA Application Security Assessment Tool Survey, V3.0, July 29, 2004 (to be published as a STIG)