We develop Web Application:
- Platform is Redhat 6.3/6.4
- Presentation tier is JSF2
- Persistence tier is Hibernate
- Server is JBoss 4
- Database is PostgreSQL 9.0.13.
We want to run scanner during our development to be able to find vulnerabilities as soon as possible. I do understand that it is not possible to find all vulnerabilities in the automatic way. Any case, I hope that XSS and SQL injections vulnerabilities are possible to find automatically. I search site and was not able to find the answer: What tools are available to assess the security of a web application? What are some good website security scanning solutions?
I get recommendation for Burp and AppScan. Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application in our case