Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Until now I managed to look into Webscarab, Webscarab-NG, IronWASP & Burp extender.

Unfortunately, except IronWASP, that refused to compile from the GIT source, none of the projects matched my criteria (Webscarab lacked the scanner, so does Webscarab-NG & Burp extender is indeed very nice, but not open source).

Do you know about any other open source projects that might work?

share|improve this question
Shopping or product recommendation questions are not a good fit. Closing. – Rory Alsop♦ Jun 1 '12 at 7:19
I guess I have a slightly different perspective. I think this is a fine question, and the fact that it got some good useful answers is evidence that it is an OK fit for this site. I advocate re-opening it. – D.W. Jun 4 '12 at 5:58

closed as not constructive by Iszi, Scott Pack, Rory Alsop♦ Jun 1 '12 at 7:18

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 2 down vote accepted

Wapiti (python) and Skipfish (C/C++) are both good open source scanners that are not bad. My biggest complaint is that they are overly simplistic, for instance Skipfish doesn't actually have an html parser, instead it uses a system of overly simplistic regular expressions. Wapiti uses Python's html parser, which is better, however Wapiti isn't actively maintained. Skipfish's biggest problem is that it will DoS web application with the traffic it produces, so I wouldn't run it on a production system.

I studied both of these projects when building my scanner Sitewatch, we provide a free service and its better than any open source web application scanner I am aware of.

share|improve this answer
up vote 2 down vote

SecToolAddict has a very in-depth review of many commercial, free, open, and closed source scanners. You will find many high quality options there. His new round of tests are starting soon.

From my personal experience, I can vouch for w3af and arachni as having spiders and being effective scanners. Both of them are open-source, under active development, and rank highly in the sectooladdict tests.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.