I'm working on a web project and need to give a quick update on how the security of the web site. So is there any tool or browser plugin to do a quick scan for my web project and get an analysis report.
Yes for a few things but overall really I feel the answer is no single tool for what you seek.
Reviewing security is a manual process because it is is a multi-faceted process. It will frequently involve using various tools but there is not an overarching tool you can use to simply run a security report that I am aware of.
Also, if such a tool exists it will be of limited use as a broswer plugin, given that most of the security issues require analysis on the backend - and for that, there are security scan tools - but even these do not fully suffice because intent will not be clear just from the static code analysis.
A browser tool could report on:
- If HTTPS is being used
- Any hidden code in the HTML not displayed
- XSS (Cross Site Scripting)
Server side tools can report on:
- SQL injection
- Username/password storage in code (bad!)
- Large scale SQL updates
- Security in the application code
- Calls to other services
- Many other security concerns
Above are not comprehensive lists for security testing.
For that buy a security testing book and spend $20 to earn $80000
https://cwatch.comodo.com/blog/website-security/top-10-vulnerability-assessment-scanning-tools/ (March 2018)
Top 10 Vulnerability Assessment Scanning Tools
- Comodo HackerProof
- Nexpose Community
- Tripwire IP360
- Nessus Professional
- Retina CS Community
- Microsoft Baseline Security Analyzer (MBSA)