Performance and coverage comparison of scan models

[Tasos Laskos]

Hey guys,

I'm assuming that you've done extensive benchmarks while developing Gryffin, since that's pretty much unavoidable in these cases, and I'd like to urge you to publish them.
I'm sure that most of us technical folk would like to see the performance and coverage characteristics of different scan models.

Performance

Since Arachni is the only dependency that overlaps with Gryffin's features, it'd be interesting to see a comparison for a few scenarios:

• Gryffin (all fuzzers) vs Arachni (configured with identical checks and scope)
• Gryffin (Arachni only) vs Arachni (configured with identical checks and scope)
• Gryffin (crawl only) vs Arachni (crawl only -- same scope, no checks loaded)

Along with permutations on the above such as:

• Single node scan vs multi-node scan
• Single webapp scan vs multi-webapp scan

In a crawl-only situation I'm assuming that Gryffin will do better, in a full scan situation though performance characteristics get trickier as Arachni has no distinct crawl/audit phases.
Since the crawl operations can be seen as a much smaller subset of the audit operations, the crawl becomes an unnecessary redundancy when performing a full scan.

Personally, I'd like to see in which cases Gryffin's distributed crawl and deduplication start overtaking Arachni's no-crawl, on-the-fly scan model.

Coverage

Have you tried Gryffin's crawler on coverage benchmarks such as WIVET?
We already have the score of pretty much every scanner available, so it'd be nice seeing how Gryffin does against existing ones.

Thanks for your time and for publishing Gryffin, looks very interesting. :)

Cheers,
Tasos L.

[Albert Yu]

Personally, I'd like to see in which cases Gryffin's distributed crawl and deduplication start overtaking Arachni's no-crawl, on-the-fly scan model.

I think Gryffin may perform better when it is integrated with more lightweight fuzzers. In particular for the case where system administrators or penetration testers write their own regression tests against their system. And as you have already mentioned in #9, the trade-off of such would be the process cold start overhead.

Have you tried Gryffin's crawler on coverage benchmarks such as WIVET?

The render.js script was initially designed to deal with the cases in WIVET. I can't recall the actual score, @adon-at-work may have that, as he is the author of it. It should be somewhere above 90. However, once render.js is integrated with Gryffin, other features like similarity detection may avoid us to retain that score.

[Rachael Andrew]

This project is being archived.