Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It only takes a minute to sign up.
Sign up to join this community
Is there any tool similar like Acunetix?, because it's really "user-friendly" for me, and I haven't found something similar yet, preferable with a cheaper price.
So what I like from Acunetix is clear descriptions about vulnerabilities, affected items, impact of the vulnerability and how to fix this vulnerability, also the tool explorer and export scan.
If you'd like to find security vulnerabilities in web applications, you should look at the OWASP Zed Attack Proxy Project at www.owasp.org. The project is open-source so it fits your price range. It runs on Java so it's cross-platform. It provides automated scanners as well as tools for manually locating security holes. It is mature, well-documented and supported. You can find it here: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
There are open source and free (as in beer) versions of vulnerability scanners. Some of which will perform similar tests to Acunetix. Some of which will only have a subset of those tests.
Many of them, however, are not bundled up as nicely and won't provide the snazzy features/interface Acunetix does. The two primary ones I can think of are Vega, which has already been mentioned, and OpenVAS. Both will perform similar types of tests against your endpoints, but neither will have that full functionality.
As Jerry Penner noted, ZAP can do some of this as well, though it requires manual configuration and supplying many of the non-generic test cases yourself. Burp PRO (which is what ZAP emulates) costs about $300 a year for a license, and is well maintained and has several built in tools that update regularly. I am a big fan of Burp and use it almost daily.
