Performance Evaluation of Open-Source Web Vulnerability Scanners for SQL Injection Detection in Web Applications

Small and Medium Enterprises (SMEs) are embracing online platforms which results in becoming more exposed to cybersecurity threats, especially SQL Injection (SQLi) attacks. SQLi attack is among the most common web application vulnerabilities listed by OWASP. To address these risks, this research examines the performance of several open-source Web Vulnerability Scanners (WVS) in detecting SQLi threats. Four popular open-source scanners: OWASP ZAP, SQLmap, Skipfish and Wapiti have been tested across five types of web applications. Vulnerable testbeds such as DVWA and OWASP Mutillidae II and the real e-commerce sites have been tested to see how the tools perform in practical situations. All the scanners have been evaluated based on few parameters: detection rate, response time, resource usage on CPU and memory and ease of use. The scanners show variations of results during the experiment. These findings offer useful guidance for SMEs in choosing cost-effective and efficient scanning tools that match their cybersecurity needs.