Security Testing - Automation Tools

Open Source Tools

Some open source security testing tools are as given −

S.No.	Tool Name
1	Zed Attack Proxy Provides Automated Scanners and other tools for spotting security flaws. https://www.owasp.org
2	OWASP WebScarab Developed in Java for Analysing Http and Https requests. https://www.owasp.org/index.php
3	OWASP Mantra Supports multi-lingual security testing framework https://www.owasp.org/index.php/OWASP_Mantra_-_Security_Framework
4	Burp Proxy Tool for Intercepting & Modyfying traffic and works with work with custom SSL certificates. https://www.portswigger.net/Burp/
5	Firefox Tamper Data Use tamperdata to view and modify HTTP/HTTPS headers and post parameters https://addons.mozilla.org/en-US
6	Firefox Web Developer Tools The Web Developer extension adds various web developer tools to the browser. https://addons.mozilla.org/en-US/firefox
7	Cookie Editor Lets user to add, delete, edit, search, protect and block cookies https://chrome.google.com/webstore

The following tools can help us spot a particular type of vulnerability in the system −

S.No.	Link
1	DOMinator Pro − Testing for DOM XSS https://dominator.mindedsecurity.com/
2	OWASP SQLiX − SQL Injection https://www.owasp.org/index.php
3	Sqlninja − SQL Injection http://sqlninja.sourceforge.net/
4	SQLInjector − SQL Injection https://sourceforge.net/projects/safe3si/
5	sqlpowerinjector − SQL Injection http://www.sqlpowerinjector.com/
6	SSL Digger − Testing SSL https://www.mcafee.com/us/downloads/free-tools
7	THC-Hydra − Brute Force Password https://www.thc.org/thc-hydra/
8	Brutus − Brute Force Password http://www.hoobie.net/brutus/
9	Ncat − Brute Force Password https://nmap.org/ncat/
10	OllyDbg − Testing Buffer Overflow http://www.ollydbg.de/
11	Spike − Testing Buffer Overflow https://www.immunitysec.com/downloads/SPIKE2.9.tgz
12	Metasploit − Testing Buffer Overflow https://www.metasploit.com/

Here are some of the commercial black box testing tools that help us spot security issues in the applications that we develop.

S.No	Tool
1	NGSSQuirreL https://www.nccgroup.com/en/our-services
2	IBM AppScan https://www-01.ibm.com/software/awdtools/appscan/
3	Acunetix Web Vulnerability Scanner https://www.acunetix.com/
4	NTOSpider https://www.ntobjectives.com/products/ntospider.php
5	SOAP UI https://www.soapui.org/Security/getting-started.html
6	Netsparker https://www.mavitunasecurity.com/netsparker/
7	HP WebInspect http://www.hpenterprisesecurity.com/products

S.No	Tool
1	OWASP Orizon https://www.owasp.org/index.php
2	OWASP O2 https://www.owasp.org/index.php/OWASP_O2_Platform
3	SearchDiggity https://www.bishopfox.com/resources/tools
4	FXCOP https://www.owasp.org/index.php/FxCop
5	Splint http://splint.org/
6	Boon https://www.cs.berkeley.edu/~daw/boon/
7	W3af http://w3af.org/
8	FlawFinder https://www.dwheeler.com/flawfinder/
9	FindBugs http://findbugs.sourceforge.net/

These analyzers examine, detect, and report the weaknesses in the source code, which are prone to vulnerabilities −

S.No	Tool
1	Parasoft C/C++ test https://www.parasoft.com/cpptest/
2	HP Fortify http://www.hpenterprisesecurity.com/products
3	Appscan http://www-01.ibm.com/software/rational/products
4	Veracode https://www.veracode.com
5	Armorize CodeSecure http://www.armorize.com/codesecure/
6	GrammaTech https://www.grammatech.com/