There are tons of tools and it's really a personal preference on what will one use for a pentest. So try all of those mentioned by me and others and choose ones that fit you best.
For security code review (whitebox test), I'd recommend using RIPS. It's the best among those I tried.
For doing some blackbox testing, you certainly need some intercepting proxy. There's a lot of those, but I'd suggest you take a look at Fiddler if you're on Windows. Burp / WebScarab / Zed Attack Proxy are great too. If you want to automate some of the injection tests, grab some common payloads from fuzzdb.
Also, make yourself familiar with browser addons like Firebug and Chrome Developer Tools, they are a great help.
Finally, try bookmarks from Open Penetration Testing Bookmarks Collection. It's a huge list (just so that you know how many tools are there), but there are many gems inside.