Metasploit vs. Onapsis

It is easy to use with sufficient documentation on how to use the tools for end users or newbies. Experienced testers will find it easy to customise and configure the test cases. Just wished that I could have taken up a course on using this tool in my study days so that I could had explored more and improved my familiarity with the tool, unlike when working where access and time to explore the other features of the tool is limited

Incentivized

Onapsis is divided into 4 major components,

1. Assess
2. Comply
3. Defend
4. Control

In assess, it does a whitebox and blackbox testing of the ERP systems that have been added to the Onapsis console. It highlights relevant application issues and automates the process, also provides the solutions to implement the fix. In comply, it provides a governance on the various regulatory compliances which the firm has to follow, as well as provides a firm grip to the audit and ERP admin team. In control, it enables a workflow of 15 pre-defined parameter values within the SAP system and helps monitor, and track the changes made to those parameters. The capabilities are to either block, or request for an approval for changes made to those parameters in addition to just monitoring them. In defend, it goes through the SAP logs; and compares it with a pre-defined ruleset to alert the end-users via email or SIEM tool or both.

Incentivized

• Scanning our network for new or existing vulnerable systems.
• Automation of manual tests and exploits to allow what used to be days of effort to be squeezed into hours.
• Metasploit has become an integral part in our validation of new systems before their inclusion in our production network.

Incentivized

• Eliminating the manual process improves the overall accuracy of results and also frees up valuable resources to focus on other different projects.
• Onapsis provides great leverage to our technical teams in order to review in a standardized way of the landscape.
• Onapsis always matches vulnerabilities with useful context and finds possible solutions.
• Onapsis is usually implemented to continuously monitor, and alert us on any issues on the SAP systems. Not only this but implementing Onapsis also eliminates the network on the year-end and month-end audits and helps in making the overall process faster, smooth, efficient as well as accurate.

Incentivized

• Have encountered issues with updating especially after moving from BackTrack to Kali.
• Sometimes it gets a little buggy, but that's a rare occurrence.

Incentivized

• Multiple UIs
• No proper customization of UI log-off
• Tedious setup of Control component
• No proper error messages received

Incentivized

We don't use it.

Incentivized

Metasploit is an all around good suite of tools to test and validate potential vulnerabilites. Other tools have bits and pecies such as Nmap, Nessus, Burp Suite, etc. but Metasploit can function in the same way but more.

Incentivized

Honestly, I havent use something like Onapsis before and currently I am not aware if there is something similiar out there. They are one of a kind and is a complete suit, so is unlikelly that someone from outside will appear with a better solution.

Incentivized

• If you prevent an attack you will save a lot of money.
• There is a free version that has a lot of useful exploits.
• You can run it in an open source OS.

Incentivized

• It offers very reasonable packages.
• The customer support of Onapsis is reliable and efficient.
• It is a great platform as it shows a unified and easy-to-read different and complex topics in a simpler way.

Incentivized