Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I want use an open source tool.

There are many type of vulnerabilities like Cross Site Scripting, Denial of Service, File Access, Format Validation, Mass Assignment, SQL Injection, Session Setting etc. So, I would like to have a best fit cross platform tool to do penetration testing in a best possible way.

I've gone through Security testing of web application and Open source web security testing tools, and I found it useful. But, as it was posted a year ago, I would like to have an updated answer. Thank you.

share|improve this question

3 Answers 3

I have used Burp Suite and would recommend it for you, however the other answers in your linked answer are still valid and up to date.

share|improve this answer
    
Thanks Sam. But, Burp Suite is not open source, right? –  Rajesh C O Jul 23 at 2:57
    
Ah, sorry. They have a free version, but you are correct, it is not open source. –  Sam Woods Jul 23 at 15:35

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative.

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

Alternativeto.net also lists some other open-source projects not mentioned in your linked lists.

share|improve this answer
    
Thanks for sharing. I'll look in to that. –  Rajesh C O Jul 23 at 10:06

One tool to checkout out is OWASP ZED Attack Proxy It has lot of different ways to test a site. ZED attack proxy has an excellent wiki and many different tools to scan a site. There are fuzz testing tools. Make sure you're testing a site you own but it will attempt to attack it with common attack vectors. Some things that I have found with doing my own scans for companies have been including a session id in the cookie and other basic things. There are some videos on youtube on how to best use the tools and it seems to be a rather active organization.

share|improve this answer
    
Could you edit your answer to give more information, please? –  Kate Paulk Sep 4 at 10:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.