Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting...

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

The Open Vulnerability Assessment System (OpenVAS) is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.

Nessus is a software tool designed to identify system vulnerabilities through automated point-in-time assessments. It is capable of detecting software defects, missing patches, malware, and misconfigurations across a wide range of operating systems, devices, and applications.

Wapiti allows you to audit the security of your web applications. Wapiti is a command line tool.

📈 Measure and control your application security state; 🔎 Scan your code, containers, web and mobile applications; 🔥 Remove duplicates, validate results, and create Jira tasks in seconds; 🕜 Save your engineers time and automate your processes; ? Self-hosted.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1000 servers, and version specific problems on over 270 servers.

w3af is a Web Application Attack and Audit Framework.

LOKI is a free and simple IOC - "Incidents of Compromise" scanner - that goes beyond AV and malware scans to detect evidence of hacking.

Audit your website security and web applications for SQL injection, Cross site scripting and other web vulnerabilities with Acunetix Web Security Scanner. Download Free Edition!

HostedScan provides 24x7 alerts and detection for security vulnerabilities. Industry-standard, open-source, vulnerability scans. Automated alerts when something changes. Manage target list manually or import automatically from providers, such as AWS, DigitalOcean, and Linode...

A fully automated, active web application security reconnaissance tool. Key features: High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint - easily achieving 2000 requests per second with responsive targets.