Security Testing - Automation Tools

Quiz

There are various tools available to perform security testing of an application. There are few tools that can perform end-to-end security testing while some are dedicated to spot a particular type of flaw in the system.

Open Source Tools

Some open source security testing tools are as given −

S.No.	Tool Name
1	Zed Attack Proxy Provides Automated Scanners and other tools for spotting security flaws. https://www.zaproxy.org/
2	OWASP WebScarab Developed in Java for Analysing Http and Https requests. https://www.owasp.org/index.php
3	OWASP Mantra Supports multi-lingual security testing framework https://www.owasp.org/index.php/OWASP_Mantra_-_Security_Framework
4	Burp Proxy Tool for Intercepting & Modyfying traffic and works with work with custom SSL certificates. https://www.portswigger.net/Burp/
5	Firefox Tamper Data Use tamperdata to view and modify HTTP/HTTPS headers and post parameters
6	Firefox Web Developer Tools The Web Developer extension adds various web developer tools to the browser. https://addons.mozilla.org/en-US/firefox
7	Cookie Editor Lets user to add, delete, edit, search, protect and block cookies https://chrome.google.com/webstore

Specific Tool Sets

The following tools can help us spot a particular type of vulnerability in the system −

S.No.	Link
1	OWASP SQLiX − SQL Injection https://www.owasp.org/index.php
2	Sqlninja − SQL Injection http://sqlninja.sourceforge.net/
3	SQLInjector − SQL Injection https://sourceforge.net/projects/safe3si/
4	sqlpowerinjector − SQL Injection http://www.sqlpowerinjector.com/
5	SSL Digger − Testing SSL https://www.mcafee.com/us/downloads/free-tools
6	THC-Hydra − Brute Force Password https://www.kali.org/tools/hydra/
7	Brutus − Brute Force Password https://www.hackercoolmagazine.com/brutus-password-cracker-complete-guide/
8	Ncat − Brute Force Password https://nmap.org/ncat/
9	OllyDbg − Testing Buffer Overflow http://www.ollydbg.de/
10	Metasploit − Testing Buffer Overflow https://www.metasploit.com/

Commercial Black Box Testing tools

Here are some of the commercial black box testing tools that help us spot security issues in the applications that we develop.

S.No	Tool
1	NGSSQuirreL NGSSQuirreL Tool
2	IBM AppScan https://www-01.ibm.com/software/awdtools/appscan/
3	Acunetix Web Vulnerability Scanner https://www.acunetix.com/
4	NTOSpider https://www.ntobjectives.com/products/ntospider.php
5	SOAP UI https://www.soapui.org/Security/getting-started.html
6	Netsparker https://www.mavitunasecurity.com/netsparker/
7	HP WebInspect http://www.hpenterprisesecurity.com/products

Free Source Code Analyzers

S.No	Tool
1	OWASP Orizon https://www.owasp.org/index.php
2	SearchDiggity https://www.bishopfox.com/resources/tools
3	FXCOP https://www.owasp.org/index.php/FxCop
4	Splint http://splint.org/
5	Boon https://www.cs.berkeley.edu/~daw/boon/
6	W3af https://docs.w3af.org/en/latest/
7	FlawFinder https://www.dwheeler.com/flawfinder/
8	FindBugs http://findbugs.sourceforge.net/

Commercial Source Code Analyzers

These analyzers examine, detect, and report the weaknesses in the source code, which are prone to vulnerabilities −

S.No	Tool
1	Parasoft C/C++ test https://www.parasoft.com/cpptest/
2	HP Fortify http://www.hpenterprisesecurity.com/products
3	Appscan http://www-01.ibm.com/software/rational/products
4	Veracode https://www.veracode.com
5	Armorize CodeSecure http://www.armorize.com/codesecure/
6	GrammaTech https://www.grammatech.com/

Print Page