I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I want to use an open source tool.

There are many type of vulnerabilities like Cross Site Scripting, Denial of Service, File Access, Format Validation, Mass Assignment, SQL Injection, Session Setting, etc. So, I would like to have a best fit cross platform tool to do penetration testing in a best possible way.

I've gone through Security testing of web application and Open source web security testing tools, and I found it useful. But, as it was posted a year ago, I would like to have an updated answer.

  • Please don't use code format to call out or emphasize text - it becomes distracting when you are not actually referring to code. I have reverted your edit because the code format doesn't help your otherwise well thought-out question.
    – Kate Paulk
    Commented Jun 24, 2021 at 11:26

6 Answers 6


I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative.

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

Alternativeto.net also lists some other open-source projects not mentioned in your linked lists.


I have used Burp Suite and would recommend it for you, however the other answers in your linked answer are still valid and up to date.

  • Thanks Sam. But, Burp Suite is not open source, right? Commented Jul 23, 2014 at 2:57
  • Ah, sorry. They have a free version, but you are correct, it is not open source.
    – Sam Woods
    Commented Jul 23, 2014 at 15:35

One tool to checkout out is OWASP ZED Attack Proxy It has lot of different ways to test a site. ZED attack proxy has an excellent wiki and many different tools to scan a site. There are fuzz testing tools. Make sure you're testing a site you own but it will attempt to attack it with common attack vectors. Some things that I have found with doing my own scans for companies have been including a session id in the cookie and other basic things. There are some videos on youtube on how to best use the tools and it seems to be a rather active organization.


The open source tools available for security testing are Owasp Zed Attack Proxy, Ironwasp. Owasp Zap is used for security testing for vulnerabilities like XSS,SQL injection,CSRF attack, DoS attack.


As said above the best is probally OWASP ZAP.

  • Allows automatic scanning
  • Allows flexibility with manual testing
  • Attaches to the browser
  • Allows you to intercept and modify all requests made to the app.

Just a few benefits the app provides.


Here are a few tools to get you started with security testing of web applications,



Subgraph Vega

Kali Linux

Kali Linux has a whole bunch of pen testing tools

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.