Top 15 Open Source Security Testing Tools For 2019

1. Wapiti

Wapiti is one of the efficient web application security testing tools that allow you to assess the security of your web applications. It performs ‘black box testing,’ to check the web applications for possible vulnerability.

During the testing process, it scans the web pages and injects the testing data to check for the security lapse. Supporting the GET and POST HTTP attacks, Wapiti identifies various types of vulnerabilities, such as:

Features

File disclosure
Database Injection
XSS injection
Command Execution detection
CRLF Injection
XXE injection
Potentially dangerous files
Weak .htaccess configurations that are easy to bypass
Backup files giving disclose

Wapiti is a command-line application which is hard for beginners but easy for experts. The software requires complete knowledge of commands.

2. Zed Attack Proxy

Popularly known as ZAP, the Zed Attack Proxy is an open source, developed by OWASP. Supported by Windows, Unix/Linux and Mac OS, ZAP enables you to find a variety of security vulnerabilities in web apps, even during the development and testing phase. This testing tool is easy to use, even if you are a beginner in penetration testing.

Features

Automatic Scanner
Authentication support
AJAX spiders
Dynamic SSL certificates
Forced Browsing
Intercepting Proxy
Web Socket Support
Plug-n-hack support
REST-based API and much more.

3. Vega

Vega is a free open source web application testing tool. Written in JAVA, Vega comes with GUI interface. It is available for Windows, Linux, and Mac OS. It helps you:

Features

Find SQL injection
Validate SQL injection
File inclusions
Cross-Site Scripting (XSS)
Improve security of TLS servers

The tool also allows you to set preference such as maximum and minimum requests per second, the number of path descendants and number of nodes, etc.

Once supplied with proper credentials, you can use Vega as an automated scanner, for intercepting proxy and run it as a proxy scanner.

4. W3af

W3af is a popular web application security testing framework. Developed using Python, it offers an efficient web application penetration testing platform.

This tool can be used to detect more than 200 types of security issues in web applications, including SQL injection and Cross-Site Scripting. It checks for following vulnerabilities in the web-apps:

Features

Blind SQL injection vulnerability
Buffer overflow vulnerability
Multiple CORS misconfigurations
Insecure DAV configurations
CSRF vulnerability and much more

Available in both GUI and console interface, W3af is easy to understand. It also allows you to authenticate the website through the authentication modules.

5. Skipfish

Skipfish is a web application security testing tool that crawls the website recursively and checks each page for possible vulnerability and prepares the audit report in the end. Written in C language, Skipfish is optimized for HTTP handling and leaving minimum CPU footprints.

The software claims to handle 2K requests per second, without displaying CPU footprints. Also, the tool claims to provide high-quality positives as it uses a heuristics approach during crawling and testing web apps.

6. Ratproxy

Ratproxy is another open source web application security testing tool which can be used to find any lapse in web applications, thereby making the app secure from any possible hacking attack. This semi-automatic testing software is supported by Linux, FreeBSD, MacOS X, and Windows (Cygwin) systems.

Ratproxy is optimized to overcome security audit issues that are repeatedly faced by users in other proxy systems. This testing tool easily distinguishes between CSS stylesheets and JavaScript codes.

7. SQLMap

SQLMap is a popular open source web application security testing tool that automates the process of detecting and utilizing SQL injection vulnerability in a database of the website. Packed with a variety of features, it has a powerful testing engine that enables the test to penetrate effortlessly and perform SQL injection check on a web application.

SQLMap supports a large number of database services, including MySQL, Oracle, PostgreSQL, Microsoft SQL Server etc. Furthermore, the testing tool supports six types of SQL injection methods.

8. Wfuzz

Wfuzz is another open-source tool for a web application security testing tool that is freely available on the market. Developed in Python, this testing tool is used for brute-forcing web applications. Some of the features of Wfuzz are:

Features

Multiple Injection points
Output to HTML
Cookies fuzzing
Multi-threading
Proxy support
SOCK support
Authentication support
All parameters brute forcing (POST and GET)
Baseline request (to filter results against)
Brute force HTTP methods
Multiple proxy support
HEAD scan
Post, headers, and authentication data brute forcing

While using WFuzz, you will have to work on command line interface as there is no GUI interface available.

9. Grendel-Scan

Grendel-Scan is a useful open source web application security tool, designed for finding security lapse in the web apps. Available for Windows, Linux, and Macintosh, the tool is developed in Java.

It comes with an automated testing module which is used for detecting vulnerabilities in web applications. Besides, the software also includes many features, especially for manual penetration testing.

10. Arachni

Arachni is an open-source web application security testing tool designed to help penetration testers and administrators assess the security of web applications. This tool is developed to identify security lapse in web applications and make it hacker proof. Arachni can detect:

Features

SQL Injection
XSS
Local File Inclusion
Remote file inclusion
Invalidated redirect, and many others

Arachni supports all the main operating systems, such as MS Windows, Mac OS X, and Linux.

11. Grabber

Grabber is an open source web application scanner that detects security vulnerabilities in web apps. It is portable and designed to scan small web applications such as forums and personal websites. It can identify the following issues:

Features

Cross-Site Scripting
SQL Injection
File Inclusion
Backup files verification
Simple AJAX verification
Hybrid analysis testing for PHP application using PHP-SAT
Generation of a file for stats analysis

Grabber is a small testing tool and takes more time to scan large apps. Moreover, since it was designed for personal usage, the scanner does not have any GUI interface and no feature for PDF report generation. Grabber was developed in Python. One can easily find the source code and modify it as per the requirement.

12. Acunetix

A complete automation penetration testing tools for your application that can scan your websites for 4500+ vulnerabilities. The most astounding feature of Acunetix is that it can crawl thousands of pages without any sort of interruptions.

Features

Can easily generate many kind of technical and compliance reorts
Scans both open-source as well as custom built applications
Deep scan technology for effective scanning
Most advances SQLi and cross-site scripting testing
Effective login sequence recorder
Acusensor technology that enhances regular dynamic scan
Built-in vulnerability management module

13. Netsparker

one of the most accurate scanner out there in the market. Owing to its ability to identify deadly vulnerabilities such as SQL injection, Cross site scripting etc.

Features

Ability to scan any web related app
Coverage for more than 1000 vulnerabilities
You can also check for coding related errors
Ability to generate regulatory compliance and web application

14. Metasploit

One of the most widely used penetration testing framework. Metasploit is an open-source testing platform that helps security testers to do much more than that of vulnerability assessment.

Features

The framework is much more advanced than that of competitors
More than 1500 exploits
Meta modules for discrete tasks such as network segmentation testing
Can be used for the automation of many process
Many infiltration scenario mock up features

15. Burp Suite

Even though Burp Suite charges money for their services. They have been put to use owing to many advanced features such as,

Features

Cutting edge web-app crawler
Coverage for more than 100 vulnerabilities
Can be used for interactive Application Security testing (IAST)
JavaScript analysis using static and dynamic techniques detection of vulnerabilities within client side java script
Out-of-band techniques for augmenting conventional scanning methods