Analysis of effectiveness of black-box web application scanners in detection of stored SQL injection and stored XSS vulnerabilities

Stored SQL injection (SQLI) and Stored Cross Site Scripting (XSS) are the top most critical web application vulnerabilities in present time. Previous researches have shown that black-box scanners have relatively poor performance in detecting these two vulnerabilities. In this paper, we analyze the performance and detection capabilities of latest black-box web application security scanners against stored SQLI and stored XSS. Our analysis shows that the recent scanners are showing improved performance in detection of stored SQLI and stored XSS. We developed our custom test-bed to challenge the scanners´ capabilities to detect stored SQLI and stored XSS. Our analysis revealed that black box scanners still need improvements in detecting stored SQLI and stored XSS vulnerabilities. In addition to the results of performance tests, the paper provides a set of recommendations that could enhance performance of scanners in detecting stored SQLI and stored XSS vulnerabilities.