8 Open Source Security Testing Tools To Test Your Website

If security incidents like Heartbleed, Apple gotofail flaw, and POODLE attack have taught us anything, web security cannot be taken lightly, and even the best of us are not safe from it. Web security testing tools are helpful in proactively detecting application vulnerabilities and safeguarding websites against attacks.

Here are 8 popular open source security testing tools

Vega – It is a vulnerability scanning and testing tool written in Java. It works with OS X, Linux, and Windows platforms. It is GUI-enabled and includes an automated scanner and an intercepting proxy. It can detect web application vulnerabilities like SQL injection, header injection, cross-site scripting, etc. It can be extended through a JavaScript API.

Visit: tool link

ZED Attack Proxy (ZAP) – AWASP developed it, and is available for Windows, Unix/Linux, and Macintosh platforms. It has a high ease of use. It can be used as a scanner or to manually intercept a proxy to test a webpage. Its key features are traditional and AJAX spiders, Fuzzer, Web socket support, and a REST-based API.

Visit: tool link

Wapiti – It performs a black box scan and injects payloads to check if a script is vulnerable. It supports both GET and POST HTTP attack methods. It detects vulnerabilities like file Disclosure, file inclusion, cross-site scripting (XSS), weak .htaccess configuration, etc.

Visit: tool link

W3af is a web application audit and attack framework that is effective against over 200 vulnerabilities. It has a GUI with expert tools that can be used to send HTTP requests and cluster HTTP responses. If a website is protected, it can use authentication modules to scan them. Output can be logged into a console, a file or sent via email.

Visit: tool link

Iron Wasp – It is a powerful GUI-based scanning tool that can check over 25 kinds of web vulnerabilities. It can detect false positives and false negatives. It is built on Python and Ruby and generates HTML and RTF reports.

Visit: tool link

SQLMap – It detects SQL injection vulnerability in a website database. It can be used on many databases and supports 6 kinds of SQL injection techniques: time-based blind, boolean-based blind, error-based, UNION query, stacked queries, and out-of-band. It can directly connect to the database without SQL injection and has great fingerprinting and enumeration features.

Visit: tool link

Google Nogotofail – It is a network traffic security testing tool. It checks the application for known TLS/SSL vulnerabilities and misconfigurations. It scans SSL/TLS encrypted connections and checks whether they are vulnerable to man-in-the-middle (MITM) attacks. It can be set up as a router, VPN, or proxy server.

Visit: tool link

BeEF (Browser Exploitation Framework) detects application weakness using browser vulnerabilities. It uses client-side attack vectors to verify the security of an application. It can issue browser commands like redirection, changing URLs, generating dialogue boxes etc.

Visit: tool link

Read about the different types of security testing and tools that enable those testing in Cigniti’s Whitepaper on Security Testing Tools.