# \[SOLVED\] Web application security testing

**URL:** <https://onehack.st/t/solved-web-application-security-testing/72717>\
**Category:** Tutorials & Methods\
**Tags:** solved, freebies\
**Created:** [March 8, 2020, 11:31am UTC](https://onehack.st/t/solved-web-application-security-testing/72717 "2020-03-08T11:31:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmvramana](https://onehack.st/user_avatar/onehack.st/vmvramana/32/20484_2.png) [@vmvramana](https://onehack.st/u/vmvramana)\
**Post date:** [March 8, 2020, 11:31am UTC](https://onehack.st/t/solved-web-application-security-testing/72717/1 "2020-03-08T11:31:16Z")

</div>

I want to learn web application security testing and OWASP top 10 vulnerabilities. Can anybody provide something which help me to learn easily.

I found few in udemy but it doesn’t have complete info i think.

Please help me.

---

<div class="post-metadata">

**Author:** ![Shayla](https://onehack.st/user_avatar/onehack.st/shayla/32/174870_2.png) [@Shayla](https://onehack.st/u/Shayla)\
**Post date:** [March 8, 2020, 11:40pm UTC](https://onehack.st/t/solved-web-application-security-testing/72717/2 "2020-03-08T23:40:54Z")

</div>

# Ethical Hacking 101: Web App Penetration Testing - a full course for beginners

[![](https://img.youtube.com/vi/2_lswM1S264/maxresdefault.jpg "Ethical Hacking 101: Web App Penetration Testing - a full course for beginners") ](https://www.youtube.com/watch?v=2_lswM1S264)

Another, nice channel to have a look at it!

[https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q/videos](https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q/videos)

Some Udemy course I would recommend you to have a look for knowledge purpose, all are free, don’t worry!

[https://www.udemy.com/course/web-application-hacking-burp-proxy-part-1/](https://www.udemy.com/course/web-application-hacking-burp-proxy-part-1/)

[https://www.udemy.com/course/burp-suite/](https://www.udemy.com/course/burp-suite/)

[https://www.udemy.com/course/new-web-security-2020/](https://www.udemy.com/course/new-web-security-2020/)

## Extras

[https://www.softwaretestinghelp.com/how-to-test-application-security-web-and-desktop-application-security-testing-techniques/](https://www.softwaretestinghelp.com/how-to-test-application-security-web-and-desktop-application-security-testing-techniques/)

> **[Web Application Security, A Beginner's Guide - PDF Free Download](https://epdf.pub/web-application-security-a-beginners-guide.html)**
>
> ...

### Tools Listing

- [Abbey Scan](https://misterscanner.com/)
  - Owner: MisterScanner
  - License: Free
  - Platforms: SaaS

- [Acunetix WVS](http://www.acunetix.com/)
  - Owner: Acunetix
  - License: Commercial / Free (Limited Capability)
  - Platforms: Windows

- [Application Security on Cloud](https://www.ibm.com/us-en/marketplace/application-security-on-cloud)
  - Owner: IBM
  - License: Commercial
  - Platforms: SaaS

- [AppScan](http://www-03.ibm.com/software/products/en/appscan-standard)
  - Owner: IBM
  - License:
  - Platforms: Windows

- [App Scanner](https://www.trustwave.com/Products/Application-Security/App-Scanner-Family/App-Scanner-Enterprise/)
  - Owner: Trustwave
  - License: Commercial
  - Platforms: Windows

- [AppSpider](http://www.rapid7.com/products/appspider/)
  - Owner: Rapid7
  - License: Commercial
  - Platforms: Windows

- [AppTrana Website Security Scan](https://apptrana.indusface.com/basic/)
  - Owner: AppTrana
  - License: Free
  - Platforms: SaaS

- [Arachni](http://www.arachni-scanner.com/)
  - Owner: Arachni
  - License: Free for most use cases
  - Platforms: Most platforms supported

- [AVDS](https://www.scanmyserver.com/)
  - Owner: Beyond Security
  - License: Commercial / Free (Limited Capability)
  - Platforms: SaaS

- [BlueClosure BC Detect](https://www.blueclosure.com/)
  - Owner: BlueClosure
  - License: Commercial, 2 weeks trial
  - Platforms: Most platforms supported

- [BREACHLOCK Dynamic Application Security Testing](https://www.breachlock.com/dynamic-application-security-testing/)
  - Owner: BREACHLOCK
  - License: Commercial
  - Platforms: SaaS

- [Burp Suite](http://www.portswigger.net/)
  - Owner: PortSwiger
  - License: Commercial / Free (Limited Capability)
  - Platforms: Most platforms supported

- [Contrast](https://contrastsecurity.com/)
  - Owner: Contrast Security
  - License: Commercial / Free (Full featured for 1 App)
  - Platforms: SaaS or On-Premises

- [Detectify](https://detectify.com/)
  - Owner: Detectify
  - License: Commercial
  - Platforms: SaaS

- [Digifort- Inspect](http://www.digifort.se/en/scanner)
  - Owner: Digifort
  - License: Commercial
  - Platforms: SaaS

- [edgescan](https://www.edgescan.com/)
  - Owner: edgescan
  - License: Commercial
  - Platforms: SaaS

- [GamaScan](http://www.gamasec.com/Gamascan.aspx)
  - Owner: GamaSec
  - License: Commercial
  - Platforms: Windows

- [Grabber](http://rgaucher.info/beta/grabber/)
  - Owner: Romain Gaucher
  - License: Open Source
  - Platforms: Python 2.4, BeautifulSoup and PyXML

- [Gravityscan](https://gravityscan.com/)
  - Owner: Defiant, Inc.
  - License: Commercial / Free (Limited Capability)
  - Platforms: SaaS

- [Grendel-Scan](http://sourceforge.net/p/grendel/code/ci/c59780bfd41bdf34cc13b27bc3ce694fd3cb7456/tree/)
  - Owner: David Byrne
  - License: Open Source
  - Platforms: Windows, Linux and Macintosh

- [GoLismero](http://www.golismero.com/)
  - Owner: GoLismero Team
  - License: GPLv2.0
  - Platforms: Windows, Linux and Macintosh

- [IKare](http://www.ikare-monitoring.com/)
  - Owner: ITrust
  - License: Commercial
  - Platforms: N/A

- [ImmuniWeb](https://www.htbridge.com/immuniweb/)
  - Owner: High-Tech Bridge
  - License: Commercial / Free (Limited Capability)
  - Platforms: SaaS

- [InsightVM](https://www.rapid7.com/products/insightvm/)
  - Owner: Rapid7
  - License: Commercial with Free Trial
  - Platforms: SaaS

- [Intruder](https://www.intruder.io/)
  - Owner: Intruder Ltd.
  - License:
  - Platforms:

- [Indusface Web Application Scanning](https://www.indusface.com/index.php/products/web-application-scanning)
  - Owner: Indusface
  - License: Commercial / Free Trial
  - Platforms: SaaS

- [N-Stealth](http://www.nstalker.com/)
  - Owner: N-Stalker
  - License: Commercial
  - Platforms: Windows

- [Nessus](https://www.tenable.com/products/tenable-io/web-application-scanning/)
  - Owner: Tenable
  - License: Commercial
  - Platforms: Windows

- [Netsparker](http://www.mavitunasecurity.com/)
  - Owner: MavitunaSecurity
  - License: Commercial
  - Platforms: Windows

- [Nexpose](http://www.rapid7.com/products/nexpose-community-edition.jsp)
  - Owner: Rapid7
  - License: Commercial / Free (Limited Capability)
  - Platforms: Windows/Linux

- [Nikto](http://www.cirt.net/nikto2)
  - Owner: CIRT
  - License: Open Source
  - Platforms: Unix/Linux

- [Probely](https://probely.com/)
  - Owner: Probely
  - License: Commercial / Free (Limited Capability)
  - Platforms: SaaS

- [Proxy.app](http://www.websecurify.com/desktop/proxy.html)
  - Owner: Websecurify
  - License: Commercial
  - Platforms: Macintosh

- [QualysGuard](http://www.qualys.com/products/qg_suite/was/)
  - Owner: Qualys
  - License: Commercial
  - Platforms: N/A

- [Retina](http://www.beyondtrust.com/Products/RetinaNetworkSecurityScanner/)
  - Owner: BeyondTrust
  - License: Commercial
  - Platforms: Windows

- [Ride (REST JSON Payload fuzzer)](https://github.com/adobe/ride/blob/develop/Usage.md#the-fuzz)
  - Owner: Adobe, Inc.
  - License: Apache 2 / Free
  - Platforms: Linux / Mac / Windows

- [Securus](http://www.orvant.com/)
  - Owner: Orvant, Inc
  - License: Commercial
  - Platforms: N/A

- [Sentinel](http://www.whitehatsec.com/home/services/services.html)
  - Owner: WhiteHat Security
  - License: Commercial
  - Platforms: N/A

- [SOATest](http://www.parasoft.com/products/article.jsp?articleId=3169&redname=webtesting&referred=webtesting)
  - Owner: Parasoft
  - License: Commercial
  - Platforms: Windows / Linux / Solaris

- [Tinfoil Security](https://www.tinfoilsecurity.com/)
  - Owner: Tinfoil Security, Inc.
  - License: Commercial / Free (Limited Capability)
  - Platforms: SaaS or On-Premises

- [Trustkeeper Scanner](https://www.trustwave.com/external-vulnerability-scanning.php)
  - Owner: Trustwave SpiderLabs
  - License: Commercial
  - Platforms: SaaS

- [Vega](https://subgraph.com/vega/)
  - Owner: Subgraph
  - License: Open Source
  - Platforms: Windows, Linux and Macintosh

- [Vex](https://www.ubsecure.jp/en/about_ubsecure)
  - Owner: UBsecure
  - License: Commercial
  - Platforms: Windows

- [Wapiti](https://owasp.org/www-community/Vulnerability_Scanning_Tools)
  - Owner: Informática Gesfor
  - License: Open Source
  - Platforms: Windows, Unix/Linux and Macintosh

- [Web Security Scanner](https://www.defensecode.com/webscanner.php)
  - Owner: DefenseCode
  - License: Commercial
  - Platforms: On-Premises

- [WebApp360](http://www.tripwire.com/it-security-software/enterprise-vulnerability-management/web-application-vulnerability-scanning/)
  - Owner: TripWire
  - License: Commercial
  - Platforms: Windows

- [WebCookies](https://webcookies.org/)
  - Owner: WebCookies
  - License: Free
  - Platforms: SaaS

- [WebInspect](https://www.microfocus.com/en-us/products/webinspect-dynamic-analysis-dast)
  - Owner: Micro Focus
  - License: Commercial
  - Platforms: Windows

- [WebReaver](http://www.websecurify.com/desktop/webreaver.html)
  - Owner: Websecurify
  - License: Commercial
  - Platforms: Macintosh

- [WebScanService](http://www.german-websecurity.com/en/products/webscanservice/product-details/overview/)
  - Owner: German Web Security
  - License: Commercial
  - Platforms: N/A

- [Websecurify Suite](https://suite.websecurify.com/)
  - Owner: Websecurify
  - License: Commercial / Free (Limited Capability)
  - Platforms: Windows, Linux, Macintosh

- [Wikto](http://www.sensepost.com/research/wikto/)
  - Owner: Sensepost
  - License: Open Source
  - Platforms: Windows

- [w3af](http://www.w3af.org/)
  - Owner: [w3af.org](http://w3af.org)
  - License: GPLv2.0
  - Platforms: Linux and Mac

- [Zed Attack Proxy](https://www2.owasp.org/www-project-zap)
  - Owner: OWASP
  - License: Open Source
  - Platforms: Windows, Unix/Linux and Macintosh

### References

- [SAST Tools](https://owasp.org/www-community/Source_Code_Analysis_Tools) - OWASP page with similar information on Static Application Security Testing (SAST) Tools
- [Free for Open Source Application Security Tools](https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools) - OWASP page that lists the Commercial Dynamic Application Security Testing (DAST) tools we know of that are free for Open Source
- [http://sectooladdict.blogspot.com/](http://sectooladdict.blogspot.com/) - Web Application Vulnerability Scanner Evaluation Project (WAVSEP)
- [http://projects.webappsec.org/Web-Application-Security-Scanner-Evaluation-Criteria](http://projects.webappsec.org/Web-Application-Security-Scanner-Evaluation-Criteria) - v1.0 (2009)
- [http://www.slideshare.net/lbsuto/accuracy-and-timecostsofwebappscanners](http://www.slideshare.net/lbsuto/accuracy-and-timecostsofwebappscanners) - White Paper: Analyzing the Accuracy and Time Costs of WebApplication Security Scanners - By Larry Suto (2010)
- [http://samate.nist.gov/index.php/Web\_Application\_Vulnerability\_Scanners.html](http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners.html) - NIST home page which links to: NIST Special Publication 500-269: Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 (21 August, 2007)
- [http://www.softwareqatest.com/qatweb1.html#SECURITY](http://www.softwareqatest.com/qatweb1.html#SECURITY) - A list of Web Site Security Test Tools. (Has both DAST and SAST tools)

---

<div class="post-metadata">

**Author:** ![vmvramana](https://onehack.st/user_avatar/onehack.st/vmvramana/32/20484_2.png) [@vmvramana](https://onehack.st/u/vmvramana)\
**Post date:** [March 9, 2020, 7:53am UTC](https://onehack.st/t/solved-web-application-security-testing/72717/3 "2020-03-09T07:53:18Z")

</div>

Thank you Very much!