blocks|key|5422890|text|websecurify是我发现的最好的自由和开放源码软件项目。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://www.websecurify.com/^0|0|B|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

<a href="http://www.websecurify.com/">websecurify</a> is the best FOSS projects I have found.

blocks|key|5423032|text|您可能需要查看Google的斯基普鱼，它非常全面，可以从您提供的字典中提取，还包括默认设置(标准/厨房水槽)。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5423033|它也比我使用过的其他东西“温和”一些，但我找不到与之相比具有相同特性的东西。|5423034|它编写的C，有非常丰富的输出和非常容易使用。我建议您在任何标准*nix服务器上运行它，如果您有快速连接，则建议在家中运行。它还提供了一个具有实时更新功能的智能请求队列系统。看它起作用其实很有趣。|5423035|它报告了大多数漏洞，以及许多您可能不知道的其他问题。这是有点迂腐，但学究是一个良好的质量这样的工具。|5423036|结果截图(有点旧)：|5423037|丙氨酸氨基转移酶(alt文本文本)|entityMap|0|LINK|mutability|MUTABLE|url|http://code.google.com/p/skipfish/wiki/SkipfishDoc|1|http://skipfish.googlecode.com/files/skipfish-screen.png^0|E|4|0|0|0|0|0|0|0|H|1^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|11|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|12|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|13|8|@]|9|@]|C|$]]|$1|L|3|M|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]]]

You might want to check out Google's <a href="http://code.google.com/p/skipfish/wiki/SkipfishDoc" rel="noreferrer">Skipfish</a>, its extremely comprehensive and works from dictionaries that you supply, defaults (standard/kitchen sink) are included.

Its also a little more 'gentle' than others that I've used, but I can't find something with the same features to compare results with.

Its written C, has VERY informative output and is extremely easy to use. I recommend running it from any standard *nix server, or from home if you have a fast connection. Its also got a smart request queue system with real time updates. Its actually fun to watch it work.

It reports on most vulnerabilities, plus lots of other problems that you may not be aware of. Its a little pedantic, but pedantic is a good quality for such a tool.

Screenshot of results (a little old):

<a href="http://skipfish.googlecode.com/files/skipfish-screen.png" rel="noreferrer">alt text http://skipfish.googlecode.com/files/skipfish-screen.png</a>

blocks|key|4236881|text|有许多良好的自动化开放源码黑匣子web应用程序漏洞扫描器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4236882|w3af|unordered-list-item|4236883|websecurify|4236884|尖吻鱼|4236885|(免费，功能有限)|4236886|尼克托|offset|length|4236887|最好不要只依靠一台自动扫描仪，每个扫描仪都有各自的优点和缺点，所以总是运行其中的几个并比较结果。你还必须检查假阳性和假阴性。|4236888|自动漏洞扫描是有其位置的，但是它是有用的，但是它应该始终由一位了解漏洞并能够手动检查其他漏洞的安全专业人员进行备份。自动扫描是一个好的开端，但总比没有好。|entityMap|0|LINK|mutability|MUTABLE|url|http://cirt.net/nikto2^0|0|0|0|0|0|0|3|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|10|8|@]|9|@]|A|$]]|$1|E|3|F|5|D|7|11|8|@]|9|@]|A|$]]|$1|G|3|H|5|D|7|12|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|13|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|14|8|@]|9|@$M|15|N|16|1|17]]|A|$]]|$1|O|3|P|5|6|7|18|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|19|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y]]]]

There are many good automated open source black box web application vulnerability scanners.

<ul>
<li>w3af</li>
<li>websecurify</li>
<li>skipfish</li>
<li>Netsparker Community Edition (Free with limited functionality)</li>
<li><a href="http://cirt.net/nikto2" rel="nofollow">Nikto</a></li>
</ul>

It is best not to rely on just one automated scanner, each have their strengths and weaknesses, so always run a few of them and compare the results. You will also have to check for false positives and false negatives.

Automated vulnerability scanning has its place and is useful however it should always be backed up by a security professional who understands the vulnerabilities and can also check for further ones manually. Automated scanning is a good start and better than nothing though.

blocks|key|5422941|text|微软有一个这样做的代码分析工具+(这里是一个第九频道视频，这里是一个用于v1的下载链接+)。维基百科还有一个很好的静态代码分析工具列表。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://blogs.msdn.com/securitytools|1|http://channel9.msdn.com/posts/Jossie/Using-the-Code-Analysis-Tool-CATNET-20-to-Identify-Security-Vulnerabilities/|2|http://www.microsoft.com/downloads/details.aspx?FamilyId=0178e2ef-9da8-445e-9348-c93f24cc9f9d&displaylang=en|3|http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis^0|9|6|0|M|6|1|13|4|2|1L|6|3^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]|$A|U|B|V|1|W]|$A|X|B|Y|1|Z]|$A|10|B|11|1|12]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]|K|$5|F|G|H|C|$I|L]]|M|$5|F|G|H|C|$I|N]]|O|$5|F|G|H|C|$I|P]]]]

Microsoft has a <a href="http://blogs.msdn.com/securitytools" rel="nofollow">Code Analysis Tool</a> that does this (here is a <a href="http://channel9.msdn.com/posts/Jossie/Using-the-Code-Analysis-Tool-CATNET-20-to-Identify-Security-Vulnerabilities/" rel="nofollow">Channel 9 video</a> on it, and here is a <a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=0178e2ef-9da8-445e-9348-c93f24cc9f9d&amp;displaylang=en" rel="nofollow">download link</a> for v1). Wikipedia also has a pretty good list of <a href="http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis" rel="nofollow">static code analysis</a> tools.

blocks|key|5423146|text|谷歌的RatProxy也是检查XSS的一个很好的选择。由于它是作为代理设置和操作的，所以它很容易使用，因为它只是在您正常测试站点时跟随您的浏览器运行。它记录所有的交互、发布、获取等，并可以重放那些试图注入恶意内容的交互。一旦它重放请求，它将检查输出是否有XSS的标志。此外，它保存了整个HTTP生命周期的记录，可用于进一步的调试。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://code.google.com/p/ratproxy/^0|3|8|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

Google's <a href="http://code.google.com/p/ratproxy/" rel="nofollow">RatProxy</a> is also a really great option for check for XSS. Since it's set up and operates as a proxy, it's easy to use, as it simply follows your browser around as you test your site normally. It records all the interactions, POSTs, GETs, etc, and can replay those interactions attempting to inject malicious content. Once it replays the requests, it will check the output for the signs of XSS. Additionally, it keeps a record of the entire HTTP lifecycle, which can be used for further debugging.

blocks|key|4236698|text|HP有斯爬伯来检查常见的SQL注入漏洞。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://h30507.www3.hp.com/t5/The-HP-Security-Laboratory-Blog/Finding-SQL-Injection-with-Scrawlr/ba-p/30893^0|3|3|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

HP has <a href="http://h30507.www3.hp.com/t5/The-HP-Security-Laboratory-Blog/Finding-SQL-Injection-with-Scrawlr/ba-p/30893" rel="nofollow">Scrawlr</a> for checking common SQL Injection vulnerabilities.

blocks|key|4236779|text|我已经做了很长一段时间了，并且我会同意最好的解决方案是使用有经验的测试人员来检查您的安全配置文件，但是对这些类型的漏洞的测试实际上是非常容易自动化的。在6个月的时间里，我管理了一个测试大约1000个web应用程序的程序，我可以说，对我来说，最突出的工具是IBM的应用扫描和打嗝+--而且在大多数情况下，Burp更轻、更快、更可配置，而且非常便宜！|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4236780|很容易让Burp检查输入验证失败-并解决您的SQL注入和XSS问题。对于这些类型的漏洞，您可以得到非常好的覆盖。|entityMap|0|LINK|mutability|MUTABLE|url|http://www-01.ibm.com/software/awdtools/appscan/|1|http://portswigger.net/burp/^0|3J|8|0|3S|2|1|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]|$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@]|C|$]]]|F|$G|$5|H|I|J|C|$K|L]]|M|$5|H|I|J|C|$K|N]]]]

I have been doing exactly this sort of thing for a long time, and would agree that the best solution is to use experienced testers to check your security profile, however testing for these types of vulnerabilities is actually pretty easy to automate. Having managed a programme to test around 1000 web applications over a 6 month period, I can say the standout tools for me are <a href="http://www-01.ibm.com/software/awdtools/appscan/" rel="nofollow">IBM's AppScan</a> and <a href="http://portswigger.net/burp/" rel="nofollow">Burp</a> - and for most purposes Burp is lighter, faster, more configurable, and is a whole lot cheaper! 

Very easy to get Burp to check for input validation failures - and sort out your SQL injection and XSS issues. You can get exceedingly good coverage of these type of vulnerabilities.

blocks|key|5423301|text|w3af是最适合网络审计的部分之一，它也是自由和开放源码软件|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5423302|"w3af是一个Web应用程序攻击和审核框架。该项目的目标是创建一个框架来查找和利用易于使用和扩展的web应用程序漏洞。“|blockquote|5423303|一定要试一试|entityMap|0|LINK|mutability|MUTABLE|url|http://w3af.sourceforge.net/^0|0|4|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|F|7|T|8|@]|9|@]|C|$]]|$1|G|3|H|5|6|7|U|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

<a href="http://w3af.sourceforge.net/" rel="nofollow">w3af</a> is one of the best available pieces out there for web audit, and it's also FOSS

<blockquote>
 "w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend."
</blockquote>

make sure to give it a try

blocks|key|5423366|text|Acunetix漏洞非常好，我使用过它，并且非常喜欢它。您可以扫描网站的XSS，SQL注入，弱上传系统，等等。尽情享受吧。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

Acunetix web vulnerabbility is really good, I have used it and really like it.
You can scan website for XSS,SQL injection,weak uploading system, and many many more.
Enjoy it.

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?

Tools to check for common vulnerabilities?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

是否有任何好的工具(桌面或在线)允许您检查您的网站是否存在常见的漏洞(例如SQL注入、XSS)？

问检查常见漏洞的工具？
EN

回答 9

Webmasters Stack Exchange用户

Webmasters Stack Exchange用户

Webmasters Stack Exchange用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问检查常见漏洞的工具？EN

回答 9

Webmasters Stack Exchange用户

Webmasters Stack Exchange用户

Webmasters Stack Exchange用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问检查常见漏洞的工具？
EN