What tools do you use for vulnerability scanning?

What are your favorite tools for checking for vulnerabilities in websites?


I've used Nessus before. It takes a bit to setup, but has a pretty comprehensive set of tests.


nmap is great for giving you the ports that are open and what is running on them


  • HTTPrint
  • Nessus (which, if installed on linux, typically has nmap as a port mapper)
  • Qualys
  • MetaSploit
  • Fiddler
  • WireShark

WebInspect is pretty good, but pricey. It takes a lot of handholding as well, not a lot of automated use.