The busy holiday shopping season is upon us. Every day, millions of people log in to Web applications to make purchases. As long as they see the "yellow lock" icon on the bottom of the screen, they figure their transaction is safe, but that's not always the case. As the use of Web applications becomes more prominent, so, too, does the number of security incidents involving Web apps.

Web application vulnerabilities are a wide spread problem. According to WhiteHat Security, eight out of 10 Web sites have serious flaws. A January 2007 report published by WhiteHat estimated that about 71% of Web sites are vulnerable to cross-site scripting (XSS), followed by information leakage (30%), predictable resource location (28%), content spoofing (26%), insufficient authentication (21%) and SQL injection (20%).

It’s impossible to know how much the vulnerabilities cost businesses and consumers each year, but the number must easily run into the tens or hundreds of millions of dollars. For example, it was recently revealed that a business logic flaw in the QVS Web site allowed a woman to scam the company out of more than $400,000 in product. This person was caught, but it's possible that other people took advantage of the same flaw and never got caught. This incident shows it's more important than ever to thoroughly test your Web applications for vulnerabilities.

Manual testing is just too costly and time consuming, but fortunately there are numerous tools that automate vulnerability testing. Some of the most popular tools are NTOSpider from NT OBJECTives; WhiteHat Sentinel from WhiteHat Security; AppScan from WatchFire, now owned by IBM; and Web Inspect from Spi Dyanmics, now owned by HP. More tools in different testing categories are listed here.

Many of the vendors in the Web app assessment space come from the network assessment market. Even though there is the common goal of looking for vulnerabilities, the business of finding flaws in web applications is vastly different from searching for vulnerabilities on a network. For instance, on a network, you can use signature-based tests. For Web apps, the vulnerabilities vary too widely, and signatures don’t work well. As a result, the Web app testing tools also vary widely in their results. This can make it hard to compare tools and figure out which one(s) will work best for your environment.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.