Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Best free Vulnerability Scanners that check your websites PHP & MySQL code?

I'm looking for a free vulnerability scanner to check whether my website has common vulnerabilities and so on. Can someone list the best free vulnerability scanners?

share|improve this question

migrated from webapps.stackexchange.com Dec 18 '10 at 21:14

This question came from our site for power users of web applications.

marked as duplicate by John Conde Dec 19 '10 at 8:42

This question was marked as an exact duplicate of an existing question.

For Windows platform I could recommend Acunetix Free

OWASP developing and testing guides are awesome.

However, I think there are no 100% good options. The best way (time expensive altough) would be using cheatsheets. I mean, all tools and frameworks I know just check for some commom faults like exploiting require/includes and trying some injections.

For a better security, you should also test HTTP protocol stuff, Poison Null Byte, Fault and Boundaries Injections, XSS, CSRF and SQL Injection. Because just ensure one point does not guarantee the others (and real attackers surely will explore all options).

Using XSS, CSRF, SQL Injection and HTTP codes, surely can enhance a lot your security checks.

share|improve this answer
What's the difference between the free edition of Acunetix and the paid version? I can't find a feature comparison on their site. – Lèse majesté Dec 19 '10 at 13:23
I think the free version tests for XSS attacks but not stuff like SQL Injection. I ran their demo on a dev version of our site and didn't really care for it. It also looped on one page for some reason (a registration form) registering over 300 times, kicking off an email each time. Flooded our mail server. I didn't RTFM before running so I'll take some responsibility but it didn't really seem that helpful to me, for what it's worth. Your mileage may vary. – digit1001 Dec 28 '10 at 22:06
Well, I think you should have a Test Environment, and not run this kind of tests in production environment. And yes, security tests tend to be intensive and repetitive (they loop in several different ways to doing same thing.) – Dave Dec 29 '10 at 17:46