HackerOne vs. Nikto

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

Nikto is well suited for scanning web server-related vulnerabilities for small and medium enterprises. We can utilise it for checking server default files and security misconfigurations. It is not suited well for some users because it is CLI based tool and not a GUI based. Also, community and OEM support are not available for this tool.

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• Well known tool
• Source code available
• Wweb server vulnerability scanner

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

• Can be made GUI based for ease of users
• User community should be there
• Development and support should be available

Incentivized

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized

• Improved security posture of organisation.
• Improved in regulatory and corporate compliance.
• Easy to use result in adaptation of this tool by business users.

Incentivized