Best Opensource Tool available for Security Testing of Web applications

Question

I'm on to an R & D task for testing the security vulnerabilities that can happen in a web application. I wants to use an open source tool.

There are many type of vulnerabilities like Cross Site Scripting, Denial of Service, File Access, Format Validation, Mass Assignment, SQL Injection, Session Setting etc. So, I would like to have a best fit cross platform tool to do penetration testing in a best possible way.

I've gone through Security testing of web application and Open source web security testing tools, and I found it useful. But, as it was posted a year ago, I would like to have an updated answer.

Answer 1

I have no experience with security testing of web-applications. But if you look at alternatives to Burp which Sam Woods mentions. Then w3af looks like a solid open-source alternative.

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

Alternativeto.net also lists some other open-source projects not mentioned in your linked lists.

• http://ironwasp.org/

Answer 2

I have used Burp Suite and would recommend it for you, however the other answers in your linked answer are still valid and up to date.

Answer 3

One tool to checkout out is OWASP ZED Attack Proxy It has lot of different ways to test a site. ZED attack proxy has an excellent wiki and many different tools to scan a site. There are fuzz testing tools. Make sure you're testing a site you own but it will attempt to attack it with common attack vectors. Some things that I have found with doing my own scans for companies have been including a session id in the cookie and other basic things. There are some videos on youtube on how to best use the tools and it seems to be a rather active organization.

Answer 4

The open source tools available for security testing are Owasp Zed Attack Proxy, Ironwasp. Owasp Zap is used for security testing for vulnerabilities like XSS,SQL injection,CSRF attack, DoS attack.

Answer 5

As said above the best is probally OWASP ZAP.

• Allows automatic scanning
• Allows flexibility with manual testing
• Attaches to the browser
• Allows you to intercept and modify all requests made to the app.

Just a few benefits the app provides.