Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any open source solutions for testing web security vulnerabilities? I am not looking to make my web application bullet proof since it'll be used internally at our organization. But I'd like to test it for the bare essentials from a web security perspective.

share|improve this question
up vote 11 down vote accepted

Zed Attack Proxy from OWASP -

And generally I would advise browsing the site to learn more about security

Metasploit community edition is free -

share|improve this answer
Burp Suite also has a free edition The professional edition, while not free is extremely cheap compared to other comparable solutions at $299 for a license. – Sam Woods Jan 15 '13 at 18:21
Good catch, I'd forgotten that one, though how I could forget a product with such a wonderful name... – Phil Kirkham Jan 15 '13 at 19:53
The OWASP group is a great source of info. ZAP and the WebGoat project can teach you a LOT. Webgoat is even guided, almost like taking a class. Once you feel comfortable with those concepts, download and explore some of the pre-packaged distros for this like BackTrack or SamuraiWTF. Then set up a VM and see what you can do! – maznika Feb 1 '13 at 18:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.