1–10 of 10 posts
Netsparker - A False-Positive-Free Web Application Security Scanner
mavitunasecurity.com
How can you have blind-/boolean based SQL injection without any false positives? I would at least expect some level of false positives for these methods as they generally imply causation from correlation.
But, copy writing is art and science. Keep the fluff away from HN skeptics, and you should be fine. :-)
How can you have blind-/boolean based SQL injection without any false positives? I would at least expect some level of false positives for these methods as they generally imply causation from correlation.
How can you have any kind of system without false positives? Even medical tests have false positives, and there is a lot more review than this stuff. But, copy writing is art and science. Keep the fluff away from HN skeptics, and you should be fine. :-)
How can you have blind-/boolean based SQL injection without any false positives? I would at least expect some level of false positives for these methods as they generally imply causation from correlation.
I already using Netsparker for 3 years, they're best solution
* True positive = correctly identified
* False positive = incorrectly identified
* True negative = correctly rejected
* False negative = incorrectly rejected
Using these four values, we can actually calculate the likelihood of a given event.
However, to have high specificity (low false positives) you must lower sensitivity (false negatives). So what you are doing is reducing a type 1 error in exchange for an increase of a type 2 error. Sensitivity is related to ability to identify positive results!
This particularly disastrous in security, since we can determine likelihood from good statistics; and use this in our risk management 'risk = impact * likelihood.'