SANS ISC: Web App Testing Tools - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

As security testers we tend to always be on the lookout for new or updated tools to test the security of web based applications. Some of these are of course commercial, but most of us also make extensive use of the free and/or open source offerings. In no particular order here are the ones I am currently making use of:

Burp Suite - http://portswigger.net/suite/
Fiddler2 - http://www.fiddler2.com/fiddler2/
Watcher - http://websecuritytool.codeplex.com/
Ratproxy - http://code.google.com/p/ratproxy/
Grendel Scan - http://grendel-scan.com/
W3AF - http://w3af.sourceforge.net/
Skipfish - http://code.google.com/p/skipfish/
Exploit-me - http://labs.securitycompass.com/index.php/exploit-me/
Wikto - http://www.sensepost.com/research/wikto/
Tamper data - http://tamperdata.mozdev.org/
Wmap - http://www.metasploit.com/redmine/projects/framework/wiki/WMAP
Nikto - http://cirt.net/nikto2

Special mention to Samurai WTF - http://samurai.inguardians.com/

Please let us know if there are any I haven't mentioned that you find useful, and why! I'll add them to an update of the list after wards.

firebug - http://getfirebug.com/
webscarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
curl and wget
Various versions of different web browsers
Various scripts in different scripting languages

I've deliberately decided to exclude commercial scanners, either web application specific or network scanners that can also do some web application tests.

Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.