What tools do you use for vulnerability scanning?
What are your favorite tools for checking for vulnerabilities in websites?
I've used Nessus before. It takes a bit to setup, but has a pretty comprehensive set of tests.
nmap is great for giving you the ports that are open and what is running on them
- HTTPrint
- Nessus (which, if installed on linux, typically has nmap as a port mapper)
- Qualys
- MetaSploit
- Fiddler
- WireShark
WebInspect is pretty good, but pricey. It takes a lot of handholding as well, not a lot of automated use.