How to Perform Web Application Penetration Testing With Acunetix

Key takeaways

• Acunetix is an automated scanner for web applications and APIs. It is one tool in a test, not the test.
• Always get written authorisation before scanning. Practise on test targets such as DVWA or a vendor-provided test site.
• Authenticated scans find far more than unauthenticated ones, because most of the application is behind login.
• Validate findings manually. Scanners produce false positives and miss logic flaws.
• Report by risk, with evidence and fixes, mapped to OWASP Top 10 categories.

What is Acunetix?

Acunetix is a commercial dynamic application security testing (DAST) scanner. It crawls a web application or API, sends test requests and looks for vulnerability classes such as SQL injection, cross-site scripting, misconfigurations and outdated components. It is not open source, so check the vendor's current licensing and features on its own website. For free alternatives, see our post on OWASP ZAP.

Before you scan: authorisation and scope

Scanning a website you do not own, or have no written permission to test, is illegal and can be prosecuted under India's IT Act. A scanner sends many requests and can slow or break fragile applications, so agree these in writing before you start:

• The exact hosts, URLs and APIs in scope, and what is out of scope.
• Test windows and rate limits.
• Whether you may use destructive checks or only safe ones.
• A contact person if something breaks.
• Test accounts and where to send results.

For practice, use your own lab: a VM running DVWA, or a deliberately vulnerable test site that its owner provides for scanner testing.

How do you run a scan step by step?

1. Install and licence. Use the official installer and the licence or trial you are entitled to. Keep the scanner on a patched, isolated machine.
2. Add the target. Enter the base URL. Set the scope so the crawler does not wander to other sites.
3. Choose a scan profile. A full scan, a high-risk-only scan or a specific check set. Start with a profile suited to the environment: gentler for production, fuller for a test copy.
4. Configure authentication. Provide a test user, or record a login sequence, so the scanner can reach pages behind login. Use accounts with different roles when you can.
5. Add API definitions (OpenAPI or Postman collection) if the application has APIs, so endpoints are not missed.
6. Run the scan and watch it. Monitor the site structure found, scan speed and errors. Pause if the application struggles.
7. Review results. Sort by severity, but read the evidence for each.

How do you validate findings?

Treat every scanner result as a lead. Replay the request in a proxy tool, check the response, and test safely whether the issue is real. For a reflected XSS finding, confirm the payload is reflected unencoded in a context where script would run. For SQL injection, confirm a behavioural difference without extracting data you should not touch. Mark confirmed, false positive or needs more testing.

What does a scanner miss?

• Business logic flaws, such as changing a price or order ID in a request.
• Broken access control between users (insecure direct object references), which needs knowledge of roles.
• Multi-step workflows and race conditions.
• Issues behind complex authentication or unusual client-side code.

That is why a penetration test combines scanning with manual testing in a proxy such as Burp Suite. The OWASP Top 10 shows which classes are best found by tools and which need people.

How do you write the report?

For each finding: title, affected URL, severity, description, evidence (request and response), business impact and a fix. Map to OWASP Top 10 categories. Add an executive summary in plain language. Include scope and what was not tested. Offer a retest after fixes.

Common mistakes

• Running only an unauthenticated scan and reporting a clean result.
• Reporting scanner output without validation.
• Scanning production at full speed during business hours.
• Not checking for rate limiting or WAF blocks that hide findings.

Acunetix compared with other options

Burp Suite is the standard manual testing proxy, with a scanner in its professional edition. OWASP ZAP is free and open source. Nessus and OpenVAS focus on hosts and services rather than web application logic. Choose by budget, team skills and workflow, and treat vendor feature lists with care.

Next steps

Learn web testing methodically in WebAsha's web application hacking and security course. Related reading: top 5 penetration testing tools for web application security.