Kali Linux vs. Metasploit vs. Fortify by OpenText

Kali Linux is especially well suited in environments where high security is needed for your custom developed applications. This is well suited for offensive testing your high security in house developed applications. It is also very good for doing penetration testing on in house developed applications and safe guarding them from external attackers. Kali Linux is tough for use as a day to day Linux operating system as this was never intended to be used by beginners and occasional Linux users.

Incentivized

It is easy to use with sufficient documentation on how to use the tools for end users or newbies. Experienced testers will find it easy to customise and configure the test cases. Just wished that I could have taken up a course on using this tool in my study days so that I could had explored more and improved my familiarity with the tool, unlike when working where access and time to explore the other features of the tool is limited

Incentivized

It is best suited for runtime application security scanning and very useful for automation. You can seemlessly integrate with pipeline for dynamic scans. Cloud based apps can also be scanned for vulnerabilities, cross site scripting attacks. Basically all OWASP TOP 10. It is less appropriate to use if you have serverless architecture

Incentivized

• Analyzing SSL certificates
• Analyzing SSL server configurations
• Vulnerability scanning
• Port scanning

Incentivized

• Easy to use.
• Many exploits available.
• Multi-platform.

Incentivized

• DAST Scanning
• API Scanning
• Less detection of false positive

Incentivized

• Option to deselect tools upon install
• Instructions for all the tools
• Lightweight install option

Incentivized

• More robust menus
• Better plugin inter-operation

Incentivized

• Reporting could be better
• Can be an involved setup if your organization is not using common build tools
• Users get spammed with a lot of email updates from the service

Incentivized

Since every firm needs to perform static code analysis on their applications, I believe Micro Focus Fortify WebInspect would work well for them (they also offer dynamic scanning, although I haven't used it myself). Different static analysis tools scan code in different ways, and Micro Focus Fortify WebInspect asks you to submit a complete build of the application along with debugging files. Depending on how your company builds its apps, this requirement may be simple or challenging.

Incentivized

It is a cloud-based platform which can provide us a very useful and unique features like Application Assessment, Scans, Vulnerability Test, Comprehensive Reporting, Monitoring, etc. Fortify by Open Text is also outstanding in various parameters for the support and integration and it is highly adaptable in various DevOps Program where you need secure app testing with all given features.

Incentivized

We don't use it.

Incentivized

Always receive excellent support from the vendor. No issues there.

Incentivized

I will Stack Kali Linux at the top of among to its similar devices.

Incentivized

Metasploit is the most well-known tool in the average pen tester's toolkit. It's hard to compare to its neighbor's due to its size and following.

Incentivized

Fortify Application Defender is a little more timely and upfront with a lot of their information on cyber security. we like what they provide and how they communicate with our users. I think they have a good understanding and practice in their field. they seem best suited for us and the best fit.

Incentivized

• Costs
• Time taken to setup
• Configurations needed for each use

Incentivized

• Positive: Improves efficiency of our network penetration testing operations.
• Positive: Allows for collaboration and information sharing during a penetration test.

Incentivized

• DevSecOps helped in reducing efforts
• License cost was less
• We could roll out double the count of applications with implementation of WebInspect

Incentivized