{'fraction_non_alphanumeric': 0.021297192642787996, 'fraction_numerical': 0.0, 'mean_word_length': 5.714285714285714, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Even Hackers Deserve Usability : An Expert Evaluation of Penetration Testing Tools

Penetration testing is a necessary task to prevent or mitigate network intrusion. System administrators often use various penetration testing tools to aid in testing their networks; systems administrators, however, often do not have significant security expertise. It is thus important that penetration testing tools be usable by non-security experts. Here we examine the extent to which two commonly used penetration testing tools, Nessus and Metasploit, are usable by non-experts using a heuristic walkthrough. We identify pitfalls in user interface design, software configuration, and user notification which may hamper a nonsecurity expert’s ability to use such tools effectively. We propose user interface improvements to address issues identified by our evaluation. We also report on the efficacy of the domain-specific heuristics we selected for penetration testing usability. Keywords—Usable Security; Expert Evaluation; Administrative Tools