Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?

share

locked by Stephen Ostermiller Dec 16 at 2:32

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

    
Just keep in mind that tool won't detect all the possible security flaw of your site. If I was you I would focus more on learning and using the best pratice of security rather then using tool to detect possible flaw. –  HoLyVieR Jul 8 '10 at 23:39
1  
@HoLyVieR: There's no reason why you can't use both. Just like scanners, developers aren't perfect. It's possible for you or someone on your team or the developer of a 3rd party component to have made mistakes. Even if you manually pore over every single line of code that goes into your application, you could still overlook something. Pen testing and using vulnerability scanners gives you an extra layer of protection. It's well worth the effort IMO. –  Lèse majesté Dec 24 '11 at 4:39

9 Answers 9

up vote 10 down vote accepted

websecurify is the best FOSS projects I have found.

share
2  
For those who don't know what FOSS is (like me 20 seconds ago), it stands for Free and Open Source Software (en.wikipedia.org/wiki/Free_and_open_source_software) –  Paperjam Jul 8 '10 at 21:14
2  
And if you're feeling multi-lingual, FLOSS means the same thing AND is great for your gums! –  JasonBirch Jul 18 '10 at 1:13

Microsoft has a Code Analysis Tool that does this (here is a Channel 9 video on it, and here is a download link for v1). Wikipedia also has a pretty good list of static code analysis tools.

share

You might want to check out Google's Skipfish, its extremely comprehensive and works from dictionaries that you supply, defaults (standard/kitchen sink) are included.

Its also a little more 'gentle' than others that I've used, but I can't find something with the same features to compare results with.

Its written C, has VERY informative output and is extremely easy to use. I recommend running it from any standard *nix server, or from home if you have a fast connection. Its also got a smart request queue system with real time updates. Its actually fun to watch it work.

It reports on most vulnerabilities, plus lots of other problems that you may not be aware of. Its a little pedantic, but pedantic is a good quality for such a tool.

Screenshot of results (a little old):

alt text

share
    
That looks really nice. I will check that out for sure. –  jessegavin Jul 9 '10 at 15:32

HP has Scrawlr for checking common SQL Injection vulnerabilities.

share

Google's RatProxy is also a really great option for check for XSS. Since it's set up and operates as a proxy, it's easy to use, as it simply follows your browser around as you test your site normally. It records all the interactions, POSTs, GETs, etc, and can replay those interactions attempting to inject malicious content. Once it replays the requests, it will check the output for the signs of XSS. Additionally, it keeps a record of the entire HTTP lifecycle, which can be used for further debugging.

share

I have been doing exactly this sort of thing for a long time, and would agree that the best solution is to use experienced testers to check your security profile, however testing for these types of vulnerabilities is actually pretty easy to automate. Having managed a programme to test around 1000 web applications over a 6 month period, I can say the standout tools for me are IBM's AppScan and Burp - and for most purposes Burp is lighter, faster, more configurable, and is a whole lot cheaper!

Very easy to get Burp to check for input validation failures - and sort out your SQL injection and XSS issues. You can get exceedingly good coverage of these type of vulnerabilities.

share

w3af is one of the best available pieces out there for web audit, and it's also FOSS

"w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend."

make sure to give it a try

share

There are many good automated open source black box web application vulnerability scanners.

  • w3af
  • websecurify
  • skipfish
  • Netsparker Community Edition (Free with limited functionality)
  • Nikto

It is best not to rely on just one automated scanner, each have their strengths and weaknesses, so always run a few of them and compare the results. You will also have to check for false positives and false negatives.

Automated vulnerability scanning has its place and is useful however it should always be backed up by a security professional who understands the vulnerabilities and can also check for further ones manually. Automated scanning is a good start and better than nothing though.

share

Acunetix web vulnerabbility is really good, I have used it and really like it. You can scan website for XSS,SQL injection,weak uploading system, and many many more. Enjoy it.

share
    
I believe the free version only scans for XSS though. The non-free version is like several thousands of dollars (over $4000) per license I believe. –  Lèse majesté Dec 24 '11 at 4:34
    
Well, actually I use non-free version, and recommend it. –  web designer Dec 24 '11 at 4:36
    
Yea, if you can afford it, Acunetix WVS looks like a really good product. They have a lot of good security tips on their blog as well. –  Lèse majesté Dec 24 '11 at 4:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.