Tell me more ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.
up vote 2 down vote favorite
2

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd like to test it for the bare essentials from a web security perspective.

share|improve this question

1 Answer

up vote 8 down vote accepted

Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

And generally I would advise browsing the site to learn more about security

Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/

share|improve this answer
Burp Suite also has a free edition portswigger.net/burp. The professional edition, while not free is extremely cheap compared to other comparable solutions at $299 for a license. – Sam Woods Jan 15 at 18:21
Good catch, I'd forgotten that one, though how I could forget a product with such a wonderful name... – Phil Kirkham Jan 15 at 19:53
The OWASP group is a great source of info. ZAP and the WebGoat project can teach you a LOT. Webgoat is even guided, almost like taking a class. Once you feel comfortable with those concepts, download and explore some of the pre-packaged distros for this like BackTrack or SamuraiWTF. Then set up a VM and see what you can do! – maznika Feb 1 at 18:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.