35
votes

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?

2
  • Just keep in mind that tool won't detect all the possible security flaw of your site. If I was you I would focus more on learning and using the best pratice of security rather then using tool to detect possible flaw.
    – HoLyVieR
    Jul 8, 2010 at 23:39
  • 1
    @HoLyVieR: There's no reason why you can't use both. Just like scanners, developers aren't perfect. It's possible for you or someone on your team or the developer of a 3rd party component to have made mistakes. Even if you manually pore over every single line of code that goes into your application, you could still overlook something. Pen testing and using vulnerability scanners gives you an extra layer of protection. It's well worth the effort IMO. Dec 24, 2011 at 4:39

9 Answers 9

10
votes

websecurify is the best FOSS projects I have found.

2
5
votes

You might want to check out Google's Skipfish, its extremely comprehensive and works from dictionaries that you supply, defaults (standard/kitchen sink) are included.

Its also a little more 'gentle' than others that I've used, but I can't find something with the same features to compare results with.

Its written C, has VERY informative output and is extremely easy to use. I recommend running it from any standard *nix server, or from home if you have a fast connection. Its also got a smart request queue system with real time updates. Its actually fun to watch it work.

It reports on most vulnerabilities, plus lots of other problems that you may not be aware of. Its a little pedantic, but pedantic is a good quality for such a tool.

Screenshot of results (a little old):

alt text http://skipfish.googlecode.com/files/skipfish-screen.png

1
  • That looks really nice. I will check that out for sure.
    – jessegavin
    Jul 9, 2010 at 15:32
5
votes

There are many good automated open source black box web application vulnerability scanners.

  • w3af
  • websecurify
  • skipfish
  • Netsparker Community Edition (Free with limited functionality)
  • Nikto

It is best not to rely on just one automated scanner, each have their strengths and weaknesses, so always run a few of them and compare the results. You will also have to check for false positives and false negatives.

Automated vulnerability scanning has its place and is useful however it should always be backed up by a security professional who understands the vulnerabilities and can also check for further ones manually. Automated scanning is a good start and better than nothing though.

2
votes

Microsoft has a Code Analysis Tool that does this (here is a Channel 9 video on it, and here is a download link for v1). Wikipedia also has a pretty good list of static code analysis tools.

2
votes

Google's RatProxy is also a really great option for check for XSS. Since it's set up and operates as a proxy, it's easy to use, as it simply follows your browser around as you test your site normally. It records all the interactions, POSTs, GETs, etc, and can replay those interactions attempting to inject malicious content. Once it replays the requests, it will check the output for the signs of XSS. Additionally, it keeps a record of the entire HTTP lifecycle, which can be used for further debugging.

1
vote

HP has Scrawlr for checking common SQL Injection vulnerabilities.

1
vote

I have been doing exactly this sort of thing for a long time, and would agree that the best solution is to use experienced testers to check your security profile, however testing for these types of vulnerabilities is actually pretty easy to automate. Having managed a programme to test around 1000 web applications over a 6 month period, I can say the standout tools for me are IBM's AppScan and Burp - and for most purposes Burp is lighter, faster, more configurable, and is a whole lot cheaper!

Very easy to get Burp to check for input validation failures - and sort out your SQL injection and XSS issues. You can get exceedingly good coverage of these type of vulnerabilities.

1
vote

w3af is one of the best available pieces out there for web audit, and it's also FOSS

"w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend."

make sure to give it a try

1
vote

Acunetix web vulnerabbility is really good, I have used it and really like it. You can scan website for XSS,SQL injection,weak uploading system, and many many more. Enjoy it.

3
  • I believe the free version only scans for XSS though. The non-free version is like several thousands of dollars (over $4000) per license I believe. Dec 24, 2011 at 4:34
  • Well, actually I use non-free version, and recommend it.
    – Alireza
    Dec 24, 2011 at 4:36
  • Yea, if you can afford it, Acunetix WVS looks like a really good product. They have a lot of good security tips on their blog as well. Dec 24, 2011 at 4:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.