4

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I wants to use an open source tool.

There are many type of vulnerabilities like Cross Site Scripting, Denial of Service, File Access, Format Validation, Mass Assignment, SQL Injection, Session Setting etc. So, I would like to have a best fit cross platform tool to do penetration testing in a best possible way.

I've gone through Security testing of web application and Open source web security testing tools, and I found it useful. But, as it was posted a year ago, I would like to have an updated answer.

Improve this question
1

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative.

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

Alternativeto.net also lists some other open-source projects not mentioned in your linked lists.

Improve this answer
0
0

I have used Burp Suite and would recommend it for you, however the other answers in your linked answer are still valid and up to date.

Improve this answer
2
  • Thanks Sam. But, Burp Suite is not open source, right? – Rajesh Omanakuttan Jul 23 '14 at 2:57
  • Ah, sorry. They have a free version, but you are correct, it is not open source. – Sam Woods Jul 23 '14 at 15:35
0

One tool to checkout out is OWASP ZED Attack Proxy It has lot of different ways to test a site. ZED attack proxy has an excellent wiki and many different tools to scan a site. There are fuzz testing tools. Make sure you're testing a site you own but it will attempt to attack it with common attack vectors. Some things that I have found with doing my own scans for companies have been including a session id in the cookie and other basic things. There are some videos on youtube on how to best use the tools and it seems to be a rather active organization.

Improve this answer
0
0

The open source tools available for security testing are Owasp Zed Attack Proxy, Ironwasp. Owasp Zap is used for security testing for vulnerabilities like XSS,SQL injection,CSRF attack, DoS attack.

Improve this answer
0

As said above the best is probally OWASP ZAP.

  • Allows automatic scanning
  • Allows flexibility with manual testing
  • Attaches to the browser
  • Allows you to intercept and modify all requests made to the app.

Just a few benefits the app provides.

Improve this answer
0

Here are a few tools to get you started with security testing of web applications,

OWASP

Burpsuite

Subgraph Vega

Kali Linux

Kali Linux has a whole bunch of pen testing tools

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.