Vulnerability Scanning Tools
Description
Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration. This category of tools is frequently referred to as Dynamic Application Security Testing (DAST) Tools. A large number of both commercial and open source tools of this type are available and all of these tools have their own strengths and weaknesses. If you are interested in the effectiveness of DAST tools, check out the OWASP Benchmark project, which is scientifically measuring the effectiveness of all types of vulnerability detection tools, including DAST.
Here we provide a list of vulnerability scanning tools currently available in the market.
Disclaimer: The tools listing in the table below are presented in alphabetical order. OWASP does not endorse any of the Vendors or Scanning Tools by listing them in the table below.
OWASP is aware of the Web Application Vulnerability Scanner Evaluation Project (WAVSEP). WAVSEP is completely unrelated to OWASP and we do not endorse its results, nor any of the DAST tools it evaluates. However, the results provided by WAVSEP may be helpful to someone interested in researching or selecting free and/or commercial DAST tools for their projects. This project has far more detail on DAST tools and their features than this OWASP DAST page.
Tools Listing
| Name/Link | Owner | License | Platforms | Note |
|---|---|---|---|---|
| Acunetix | Acunetix | Commercial | Windows, Linux, MacOS | Free (Limited Capability) |
| Aikido DAST | Aikido Security | Commercial or Free | SaaS, On-Premises, IDE Plugin | Aikido Security is a developer-friendly software security platform that combines multiple different scanners to deliver real-time alerts in a central system |
| Akto | Akto | Commercial | SaaS or On-Premises | 500+ tests, 2 weeks free trial available |
| API Scanning | Indusface | Commercial | SaaS | Free trial available |
| APIsec | APIsec | Commercial | SaaS | Free limited API Pen Test |
| App Scanner | Trustwave | Commercial | Windows | |
| AppCheck Ltd. | AppCheck Ltd. | Commercial | SaaS | Free trial scan available |
| Application Scanning | Indusface | Free | SaaS | Free trial available |
| AppScan | HCL Software | Commercial | Windows | |
| AppScan on Cloud | HCL Software | Commercial | SaaS | |
| AppSpider | Rapid7 | Commercial | Windows | |
| Aptori | Aptori | Commercial | SaaS or On-Premises | |
| Arachni | Arachni | Free | Most platforms supported | Free for most use cases |
| Astra Security Suite | Astra Security | Free | SaaS | Paid Option Available |
| Barrion | Barrion | Commercial or Free | SaaS | Barrion is a developer-focused platform that strengthens web application security with automated tests that detect and notify teams of potential security issues. |
| Beagle Security | Beagle Security | Commercial | SaaS | Free (Limited Capability) |
| beSECURE (formerly AVDS) | Beyond Security | Commercial | SaaS | Free (Limited Capability) |
| binskim | Microsoft | Open Source or Free | A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats | |
| Blacklock | Blacklock Security | Commercial | Any | 14-day trial |
| BlueClosure BC Detect | BlueClosure | Commercial | Most platforms supported | 2 week trial |
| BREACHLOCK Dynamic Application Security Testing | BREACHLOCK | Commercial | SaaS | |
| Burp Suite | PortSwigger | Commercial | Most platforms supported | Free (Limited Capability) |
| CI Fuzz CLI | Code Intelligence | Open Source | Most platforms supported | |
| CloudDefense | CloudDefense | Commercial | SaaS or On-Premises | CloudDefense DAST integrates with any CI/CD with just 1 line of code. It supports multiple authentication types. Perform deep DAST scans with ease. |
| Code Intelligence App | Code Intelligence | Commercial | SaaS or On-Premises | |
| Codename SCNR | Ecsypno | Commercial | MS Windows, Mac OSX, Linux (Docker) | Codename SCNR is an intelligent and unrestricted WebAppSec scanner capable of handling modern web applications. (Free Community edition available) |
| Contrast | Contrast Security | Commercial | SaaS or On-Premises | Free (Full featured for 1 App) |
| Crashtest Security | Crashtest Security | Commercial | SaaS or On-Premises | |
| Cyber Chief | Audacix | Commercial | SaaS or On-Premises | |
| CyLock EVA | CyLock | Commercial | SaaS | EVA, the extended vulnerability assessment designed and developed at CyLock. |
| Cytrix | Cytrix | Commercial | All Web Applications Supported | Automatic Penetration Testing for Web Applications & API Schema Penetration Testing |
| Deepfence ThreatMapper | Deepfence | Open Source | Linux | Apache v2 |
| Deepfence ThreatStryker | Deepfence | Commercial | Linux, Windows | |
| Detectify | Detectify | Commercial | SaaS | |
| Digifort- Inspect | Digifort | Commercial | SaaS | |
| Edgescan | Edgescan | Commercial | SaaS | |
| Escape | Escape | Commercial | SaaS | Run thousands of GraphQL security scans |
| fitoxs | fitoxs | Commercial | SaaS | fitoxs is a complete security tool for web applications and API |
| GamaScan | GamaSec | Commercial | Windows | |
| GoLismero | GoLismero Team | Open Source | Windows, Linux and Macintosh | GPLv2.0 |
| Grabber | Romain Gaucher | Open Source | Python 2.4, BeautifulSoup and PyXML | |
| GraphQL Security | Escape | Free | SaaS | Free. No account required. |
| Haxore Web Security Scanner | Haxore | Commercial or Free | SaaS | Haxore is a comprehensive web application security scanner providing DAST capabilities for modern web applications, offering both commercial and free versions. |
| Heyhack | Heyhack | Commercial | SaaS or On-Premise | Free trial available |
| Holm Security | Holm Security | Commercial | Saas or On-Premise | |
| HostedScan.com | HostedScan.com | Commercial | SaaS | Free Forever |
| iblessing | Soulghost | Open Source or Free | Scans for several security related IOS application vulnerabilities | |
| IKare | ITrust | Commercial | N/A | |
| ImmuniWeb | High-Tech Bridge | Commercial | SaaS | Free (Limited Capability) |
| InsightVM | Rapid7 | Commercial | SaaS | Free trial available |
| Intruder | Intruder Ltd. | Commercial | ||
| Invicti, formerly Netsparker | Invicti | Commercial | SaaS, Windows | |
| IOTHREAT | IOTHREAT | Commercial | SaaS | Free (View Partial Results). Full report (PRO) - 50% discount for the OWASP community with 'OWASP50'. |
| K2 Security Platform | K2 Cyber Security | Commercial | SaaS/On-Premise | Free trial available |
| Mayhem for API | ForAllSecure | Commercial | SaaS | 30-day Free Trial |
| N-Stealth | N-Stalker | Commercial | Windows | |
| Nessus | Tenable | Commercial | Windows | |
| Nexploit | NeuraLegion | Commercial | SaaS | |
| Nexpose | Rapid7 | Commercial | Windows/Linux | Free (Limited Capability) |
| Nikto | CIRT | Open Source | Unix/Linux | |
| Nikto Online | MUNSIRADO | Commercial or Free | SaaS | Online Nikto web server scanner designed to assess the security of web servers by identifying potential vulnerabilities and misconfigurations. |
| Nmmapper Tool Collections | Nmmapper | Commercial | SasS | Great Collection of Kali Tool hosted online |
| Nuclei | ProjectDiscovery | Open Source | Windows, Unix/Linux, and Macintosh | Fast and customisable vulnerability scanner based on simple YAML based DSL. |
| Online Wordpress Security Scanner | MUNSIRADO | Commercial or Free | SaaS | Online security scanner dedicated to evaluating the security of WordPress websites |
| OnSecurity Protect | OnSecurity LLP | Commercial | SaaS | Free tier and free trial available. |
| OpenApi Security | Escape | Free | SaaS | Free. No account required. |
| OpenVAS by Greenbone | greenbone | Open Source | Linux | Open source full-featured vulnerability scanner, developed and maintained by Greenbone Networks GmbH. |
| OSTE Meta Scanner | OSTEsayed | Open Source | Linux | OSTE meta scanner is a comprehensive web vulnerability scanner that combines multiple DAST scanners, including Nikto Scanner, ZAP, Nuclei, SkipFish, and Wapiti. |
| OWASP IDE VulScanner | DestinJiDee LTD | Free | IntelliJ, VSCode | The product falls under the SCA tool category and enables developers to scan third-party dependencies within their favourite IDEs i.e. IntelliJ and VSCode. |
| Pentest-Tools.com Website Scanner | Pentest-Tools.com | Commercial or Free | SaaS | Finds vulnerabilities such as XSS (testing using real browsers), Server-Side Template Injection, Code Injection (with out of band detection) and other OWASP Top 10, and more high-risk vulnerabilities. Even newer vulnerabilties such as Client-Side Prototype Pollution are included. |
| Probely | Probely | Commercial | SaaS | Free (Limited Capability) |
| prowler | prowler-cloud | Open Source | Scans for AWS, Azure, GCP and Kubernetes. | |
| Proxy.app | Websecurify | Commercial | Macintosh | |
| purpleteam | OWASP | Open Source | CLI and SaaS | GNU-AGPL v3 |
| qark | Open Source or Free | Scans for several security related Android application vulnerabilities | ||
| QualysGuard | Qualys | Commercial | N/A | |
| ReconwithMe | Nassec | Commercial | SaaS | Paid Option Available |
| ResilientX UEM | ResilientX Security | Commercial | SaaS | ResilientX UEM provides an All-in-One Continuous Testing and Monitoring solution, by integrating ASM, DAST, CSPM |
| Retina | BeyondTrust | Commercial | Windows | |
| Ride (REST JSON Payload fuzzer) | Adobe, Inc. | Open Source | Linux / Mac / Windows | Apache 2 |
| ScanRepeat | Ventures CDX | Commercial | SaaS | |
| ScanTitan Vulnerability Scanner | ScanTitan | Commercial | SaaS | Free (Limited Capability) |
| Sec-helpers | VWT Digital | Open Source or Free | N/A | |
| SecOps Solution | SecOps Solution | Commercial or Free | Windows/Linux/macOS/SaaS/On-Premises | An agent-less full-stack patch and vulnerability management platform for identifying and patching vulnerabilities in servers, virtual machines, network devices, end-points. Free trial available for upto 15 assests |
| SecPoint Penetrator | SecPoint | Commercial | N/A | |
| SecretScanner | Deepfence | Open Source | Linux | Find secrets (tokens, keys, passwords, etc) in containers and filesystems, supporting approx 140 different secret types |
| Security For Everyone | Security For Everyone | Commercial | SaaS | Free (Limited Capability) |
| Securus | Orvant, Inc | Commercial | N/A | |
| Secyour Scanner | Secyour | Commercial | Windows, Linux, MacOS | Free (Limited Capability) |
| Sentinel | WhiteHat Security | Commercial | N/A | |
| SmartScanner | SmartScanner | Commercial | Windows | Free (Limited Capability) |
| SOATest | Parasoft | Commercial | Windows / Linux / Solaris | |
| SOOS DAST | SOOS | Commercial | SaaS | Free 30-day Trial. Includes DAST & SCA (OSS Vuln detection, Licenses, Policies, SBOM). Affordable flat rate price. |
| spiderfoot | Steve Micallef | Open Source or Free | Scans for threat intelligence and mapping your attack surface. | |
| StackHawk | StackHawk | Commercial | SaaS | |
| ThreatMapper | Deepfence | Open Source | Linux | Open source vulnerability discovery and prioritization for Kubernetes, Docker, Serverless and host-based workloads |
| Threatspy | Secure Blink | Commercial or Free | SaaS | Threatspy is the heuristic Application Security Management Platform. Discovering Both Known and Unknown Vulnerabilities, Strategically Prioritized via the Reachability Framework, with Built-in Automated Remediation. |
| Tinfoil Security | Synopsys | Commercial | SaaS or On-Premises | Free (Limited Capability) |
| Trustkeeper Scanner | Trustwave SpiderLabs | Commercial | SaaS | |
| Vega | Subgraph | Open Source | Windows, Linux and Macintosh | |
| Vex | UBsecure | Commercial | Windows | |
| Vulners | Vulners Inc | Commercial or Free | Linux / Windows / Plugins / SaaS | SAST and DAST software vulnerability scanner based on the Vulners database. Including different integrations for administration and security tools, such as NMAP, Burp, Ansible and more. |
| VulnSign | VulnSign | Commercial | SaaS or On-Premises | |
| Wapiti | Informática Gesfor | Open Source | Windows, Unix/Linux and Macintosh | |
| Web Security Scanner | DefenseCode | Commercial | On-Premises | |
| WebApp360 | TripWire | Commercial | Windows | |
| WebCookies | WebCookies | Free | SaaS | |
| WebInspect | Micro Focus | Commercial | Windows | |
| WebReaver | Websecurify | Commercial | Macintosh | |
| WebScanService | German Web Security | Commercial | N/A | |
| Websecurify Suite | Websecurify | Commercial | Windows, Linux, Macintosh | Free (Limited Capability) |
| Website Security Check | CyberAnt | Commercial | SaaS | 20% off with OWASP20 |
| WPScan | WPScan Team | Commercial | Linux and Mac | Free options |
| WuppieFuzz | TNO | Open Source | Windows, Linux, Macintosh | WuppieFuzz is a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing (black box, grey box and white box). |
| Zed Attack Proxy | The ZAP Development Team | Open Source | Windows, Unix/Linux, and Macintosh | Apache-2.0 |
| ZeroThreat | ZeroThreat | Free | SaaS | ZeroThreat is a fast web app and API security scanner providing DAST capabilities with modern solutions for modern web applications, and it is free to use. |
References
- SAST Tools - OWASP page with similar information on Static Application Security Testing (SAST) Tools
- Free for Open Source Application Security Tools - OWASP page that lists the Commercial Dynamic Application Security Testing (DAST) tools we know of that are free for Open Source
- http://sectooladdict.blogspot.com/ - Web Application Vulnerability Scanner Evaluation Project (WAVSEP)
- http://projects.webappsec.org/Web-Application-Security-Scanner-Evaluation-Criteria - v1.0 (2009)
- http://www.slideshare.net/lbsuto/accuracy-and-timecostsofwebappscanners - White Paper: Analyzing the Accuracy and Time Costs of WebApplication Security Scanners - By Larry Suto (2010)
- http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners.html - NIST home page which links to: NIST Special Publication 500-269: Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 (21 August, 2007)
- http://www.softwareqatest.com/qatweb1.html#SECURITY - A list of Web Site Security Test Tools. (Has both DAST and SAST tools)