blocks|key|714541|text|我从马鹿中得到了很好的结果--它扫描你的网页表单，尝试注射和XSS攻击他们。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|714542|如果您有时间的话，我建议您获得回溯发行版--它是一个经过修改的ubuntu+liveCD，装载了nikto、马鹿、openVAS+(一叉nessus)和数百个其他伟大的安全审计工具；我在几次审计中使用过它，并取得了良好的结果--绝对值得对其上的工具进行探索。|714543|见nikto+一步一步的指南。|entityMap|0|LINK|mutability|MUTABLE|url|http://wapiti.sourceforge.net/|1|http://www.backtrack-linux.org/|2|http://dasunhegoda.com/nikto-web-vulnerability-scanner-tutorial-imawhitehat/893/^0|2|2|0|0|F|2|1|0|7|7|2^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|F|3|G|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]]|H|$I|$5|J|K|L|C|$M|N]]|O|$5|J|K|L|C|$M|P]]|Q|$5|J|K|L|C|$M|R]]]]

I've had good results from <a href="http://wapiti.sourceforge.net/" rel="nofollow noreferrer">wapiti</a> - it scans your web forms and attempts injections and XSS attacks against them.

If you have the time, I'd suggest getting the <a href="http://www.backtrack-linux.org/" rel="nofollow noreferrer">backtrack</a> distribution - it's a modified ubuntu liveCD that's been loaded up with nikto, wapiti, openVAS (a fork of nessus) and hundreds of other great security audit tools; I've used it in a few audits and had good results- it's definitely worth exploring the tools on it,.

See the nikto <a href="http://dasunhegoda.com/nikto-web-vulnerability-scanner-tutorial-imawhitehat/893/" rel="nofollow noreferrer">step by step guide here</a>.

blocks|key|4451683|text|查看尼克托|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://cirt.net/nikto2^0|2|3|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

Check out <a href="http://cirt.net/nikto2" rel="nofollow noreferrer">Nikto</a>

blocks|key|714712|text|一开始，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|714713|714714|Insecure.org排名前10位+--谁给了我们美妙的Nmap|offset|length|714715|其他一些似乎被遗漏在清单上的事情，|714716|Webshag+-+Web服务器审核工具+webshag是一个免费的，多线程的，多平台的web服务器审计工具.它是用Python编写的，它收集了web服务器审计的常用功能，如网站爬行、URL扫描和文件模糊。|unordered-list-item|714717|IEEE：SQL注入和XSS攻击的Web漏洞扫描工具的测试与比较，2007年12月17-19日，，但是，你需要IEEE访问.|714718|WebOptimization.com：服务器漏洞扫描服务+不自由！但是有14天的免费审判。|entityMap|0|LINK|mutability|MUTABLE|url|http://sectools.org/web-scanners.html|1|http://nmap.org/|2|http://www.securiteam.com/tools/5QP0L0UQAI.html|3|http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?tp=&arnumber=4459684&isnumber=4459625|4|http://www.websiteoptimization.com/services/security/^0|0|0|0|I|0|T|4|1|0|0|0|K|2|0|5|R|3|0|K|9|4^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|15|8|@]|9|@]|A|$]]|$1|C|3|D|5|6|7|16|8|@]|9|@$E|17|F|18|1|19]|$E|1A|F|1B|1|1C]]|A|$]]|$1|G|3|H|5|6|7|1D|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|1E|8|@]|9|@$E|1F|F|1G|1|1H]]|A|$]]|$1|L|3|M|5|K|7|1I|8|@]|9|@$E|1J|F|1K|1|1L]]|A|$]]|$1|N|3|O|5|K|7|1M|8|@]|9|@$E|1N|F|1O|1|1P]]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V]]|W|$5|R|S|T|A|$U|X]]|Y|$5|R|S|T|A|$U|Z]]|10|$5|R|S|T|A|$U|11]]|12|$5|R|S|T|A|$U|13]]]]

Start at, 
The <a href="http://sectools.org/web-scanners.html" rel="nofollow noreferrer">top 10 list from Insecure.org</a> -- who give us the wonderful <a href="http://nmap.org/" rel="nofollow noreferrer">Nmap</a> 

<hr>

Some other things that appear to be missed in that list,

<ul>
<li><a href="http://www.securiteam.com/tools/5QP0L0UQAI.html" rel="nofollow noreferrer">Webshag - Web Server Audit Tool</a>

<blockquote>
 webshag is a free, multi-threaded, multi-platform web server audit tool. Written in Python, it gathers commonly useful functionalities for web server auditing like website crawling, URL scanning and file fuzzing. 
</blockquote></li>
<li>IEEE: <a href="http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?tp=&amp;arnumber=4459684&amp;isnumber=4459625" rel="nofollow noreferrer">Testing and Comparing Web Vulnerability Scanning Tools for SQL Injection and XSS Attacks</a>, 17-19 Dec. 2007 
But, you will need IEEE access to for that.</li>
<li>WebOptimization.com: <a href="http://www.websiteoptimization.com/services/security/" rel="nofollow noreferrer">Server Vulnerability Scanning Service</a> 
Not free! But there is a 14 day free trial.</li>
</ul>

blocks|key|4451875|text|Paros代理是一个代理，它可以执行爬行和自动扫描。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4451876|这是一个测试它的简短手册：|4451877|Lauch+paros.jar|unordered-list-item|4451878|为本地主机配置浏览器代理:8080|4451879|浏览要分析的页面。|4451880|用‘分析->蜘蛛’选项完成列表|4451881|自动扫描“分析->扫描”|4451882|生成报表“报表->最后扫描报告”|4451883|我还喜欢w3af，它是一种更先进的web应用分析工具，类似于metasploit，但适用于web应用程序。|entityMap|0|LINK|mutability|MUTABLE|url|http://www.parosproxy.org/index.shtml|1|http://w3af.sourceforge.net/^0|0|7|0|0|0|0|0|0|0|0|0|4|4|1^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@$A|14|B|15|1|16]]|C|$]]|$1|D|3|E|5|6|7|17|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|18|8|@]|9|@]|C|$]]|$1|I|3|J|5|H|7|19|8|@]|9|@]|C|$]]|$1|K|3|L|5|H|7|1A|8|@]|9|@]|C|$]]|$1|M|3|N|5|H|7|1B|8|@]|9|@]|C|$]]|$1|O|3|P|5|H|7|1C|8|@]|9|@]|C|$]]|$1|Q|3|R|5|H|7|1D|8|@]|9|@]|C|$]]|$1|S|3|T|5|6|7|1E|8|@]|9|@$A|1F|B|1G|1|1H]]|C|$]]]|U|$V|$5|W|X|Y|C|$Z|10]]|11|$5|W|X|Y|C|$Z|12]]]]

<a href="http://www.parosproxy.org/index.shtml" rel="nofollow noreferrer">Paros Proxy</a> is a proxy that can do spidering and automated scans.

This is a short manual to test it:

<ul>
<li>Lauch paros.jar</li>
<li>Configure your browser proxy for localhost:8080</li>
<li>Navigate through the pages you want to analyze</li>
<li>Complete the list with the option 'Analyze -> Spider...'</li>
<li>Do an automatic scan 'Analyze -> Scan All'</li>
<li>Generate a report 'Report -> Last Scan Report'</li>
</ul>

I also like <a href="http://w3af.sourceforge.net/" rel="nofollow noreferrer">w3af</a> which is a more advanced tool for web app analysis, in a similar fashion of metasploit but for web apps.

blocks|key|714789|text|我使用过一些工具，而且运气很好，它们是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|714790|Burp代理|unordered-list-item|714791|惠普WebInspect+(成本)|714792|谷歌RatProxy+(要求你浏览该网站，但它工作正常，而且是免费的)|714793|加强(不是扫描器，但非常善于找到东西)|714794|Vericode|714795|我也看到了Cenzic+Hailstrom的不错的结果。|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Q|8|@]|9|@]|A|$]]|$1|E|3|F|5|D|7|R|8|@]|9|@]|A|$]]|$1|G|3|H|5|D|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]]|O|$]]

some tools I've used, and had pretty good luck with are:

<ul>
<li>Burp Proxy</li>
<li>HP WebInspect (costs money)</li>
<li>Google RatProxy (requires you to browse to the site, but it works OK and it's free)</li>
<li>Fortify (not a scanner but very good at finding stuff)</li>
<li>Vericode</li>
</ul>

I've also seen decent results from Cenzic Hailstrom.

blocks|key|4451773|text|我会使用硒或类似的工具来编写一些功能测试，这些测试使用了web应用程序。然后设置棘轮代理并重新运行测试。Ratproxy将发现XSS、XSRF和一系列其他类型的漏洞。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4451774|您也可以在不使用自动测试的情况下使用ratproxy进行一些手动测试。自动化测试只会使您认为修复了问题后更容易重新运行。|entityMap|0|LINK|mutability|MUTABLE|url|http://seleniumhq.org/|1|http://code.google.com/p/ratproxy/^0|4|1|0|14|4|1|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]|$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@]|C|$]]]|F|$G|$5|H|I|J|C|$K|L]]|M|$5|H|I|J|C|$K|N]]]]

I'd use <a href="http://seleniumhq.org/" rel="nofollow noreferrer">Selenium</a> or something similar to write some functional tests that exercised the web app. Then set up <a href="http://code.google.com/p/ratproxy/" rel="nofollow noreferrer">ratproxy</a> and rerun the tests. Ratproxy will find XSS, XSRF, and a bunch of other types of vulnerabilities.

You could also use ratproxy without the automated tests to do some manual tests. The automated tests just make it easier to rerun after you think you have fixed the problems.

blocks|key|4451933|text|我正在使用免费的在线XSS扫描工具：链接文本|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://xss-scanner.com/^0|I|4|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

I am using free online XSS scanner tool:
<a href="http://xss-scanner.com" rel="nofollow noreferrer" title="http://xss-scanner.com ">link text</a>

I'm looking for a new tool for the ol' admin toolkit and would value some suggestions.

I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along with checking for SQL injection opportunities. I realize that an automated tool approach isn't necessarily the only or best solution, but I'm hoping it would give me a nice start.

The sites I need to scan cover the range in stacks from PHP / MySQL to Coldfusion, with some classic ASP and ASP.NET mixed in for good measure.

What tools would you use to scan for Web application vulns?

(Please note I'm focusing on the web apps directly, not the servers themselves).

Web Application Vulnerability Scanner suggestions?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在寻找一个新的工具，为ol‘管理工具包，并将有价值的一些建议。我想做一些“自动”测试的几个网站XSS (跨站点脚本)秃鹫，以及检查SQL注入机会。我意识到自动化工具方法并不一定是唯一或最好的解决方案，但我希望它能给我一个好的开始。我需要扫描的站点涵盖了从PHP / MySQL到Cold聚变的堆栈范围，并混合了一些经典的ASP和ASP.NET以获得良好的效果。你会用什么工具扫描Web应用程序秃鹫

问Web应用程序漏洞扫描建议？
EN

回答 7

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Web应用程序漏洞扫描建议？EN

回答 7

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Web应用程序漏洞扫描建议？
EN