Web application vulnerability scanning provides frequent semi-automated testing of websites and web applications to identify common vulnerabilities on an ongoing basis. The applications and websites scanned are also bench marked against the OWASP Top 10 and PCI requirements for application security.

The web application vulnerability scanning service is a cost effective method of performing regular (typically monthly or quarterly) security tests. Tests involve a combination of automated security scans, coupled with manual verification of findings by a Security Test Engineer.

Web application vulnerability scanning  provides security assurance against the majority of threats faced by web applications, but it is not as exhaustive as web application security testing or security source code review.

Web application vulnerability scanning is recommended for:

• PCI and HIPAA related websites and web applications
• eCommerce and financial related websites and web applications
• Websites and web applications classified as high or medium with respect to business criticality

Web application attacks, primarily for PHP applications, and then presents a case study of a vulnerable Website that was found through Google and easily exploited. Each of the attacks we'll cover are part of a wide field of study, and readers are advised to follow the references listed in each section for further reading. It is important for Web developers and administrators to have a thorough knowledge of these attacks. It should also be noted that Web applications can be subjected to many more attacks than just those listed here.

While most of the illustrated examples in this article will discuss PHP coding due to its overwhelming popularity on the Web, the concepts also apply to any programming language. The attacks explained in this article are:

1. Remote code execution
2. SQL injection
3. Format string vulnerabilities
4. Cross Site Scripting (XSS)
5. Username enumeration

Considering the somewhat poor programming approach which leads to these attacks, the article provides some real examples of popular products that have had these same vulnerabilities in the past. Some countermeasures are offered with each example to help prevent future vulnerabilities and subsequent attacks.

This article integrates some of the critical points found in a number of whitepapers and articles on common Web application vulnerabilities. The goal is to provide an overview of these problems within one short article.


Article source: http://www.securityalliance.co.uk/security-testing/web-application-vulnerability-scanning/
Article source: http://www.symantec.com/connect/articles/five-common-web-application-vulnerabilities