Web Application Vulnerability Scanner suggestions?

Posted by Chris_K on Server Fault See other posts from Server Fault or by Chris_K
Published on 2009-07-26T13:53:23Z Indexed on 2010/04/12 15:13 UTC
Read the original article Hit count: 382

Filed under:

security

|

web-apps

|

web

|

scanner

|

vulnerabilities

I'm looking for a new tool for the ol' admin toolkit and would value some suggestions.

I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along with checking for SQL injection opportunities. I realize that an automated tool approach isn't necessarily the only or best solution, but I'm hoping it would give me a nice start.

The sites I need to scan cover the range in stacks from PHP / MySQL to Coldfusion, with some classic ASP and ASP.NET mixed in for good measure.

What tools would you use to scan for Web application vulns?

(Please note I'm focusing on the web apps directly, not the servers themselves).

© Server Fault or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about web-apps

Cannot get webapps to work after upgrade from 12.04 to 12.10

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I just upgraded to Ubuntu 12.10 from 12.04. But I cannot use WebApps. In fact there is no sign of them anywhere. Firefox and Chromium are not prompting for integration. I tried re-installing both browsers/webapps plugin of each, but no luck. Out of curiousity, I tried to install unity-webapps-preview… >>> More
Combine JavaScript and a Template Engine for Flexible Web Apps

as seen on Internet.com - Search for 'Internet.com'
Combine the power and simplicity of the TrimPath template engine with JavaScript and Ajax to develop next-generation web applications. >>> More
Combine JavaScript and a Template Engine for Flexible Web Apps

as seen on Internet.com - Search for 'Internet.com'
Combine the power and simplicity of the TrimPath template engine with JavaScript and Ajax to develop next-generation web applications. >>> More
multiple webapps in tomcat -- what is the optimal architecture?

as seen on Server Fault - Search for 'Server Fault'
I am maintaining a growing base of mainly Cocoon-2.1-based web applications [http://cocoon.apache.org/2.1/], deployed in a Tomcat servlet container [http://tomcat.apache.org/], and proxied with an Apache http server [http://httpd.apache.org/docs/2.2/]. I am conceptually struggling with the best way… >>> More
Moving Zend Framework 2 from apache to nginx

as seen on Server Fault - Search for 'Server Fault'
I would like to move site that uses Zend Framework 2 from Apache to Nginx. The problem is that site have 6 modules, and apache handles it by aliases defined in httpd-vhosts.conf, #httpd-vhosts.conf <VirtualHost _default_:443> ServerName localhost:443 Alias /develop/cpanel "C:/webapps/develop/mil_catele_cp/public" Alias… >>> More