Pentest utilities - reviews?

Question

XSS

I would like to hear feedback on commercial solutions for automated site penetration testing.
A dry squeeze from foreign blogs is of course also not bad, but the experience of living people will also be interesting to listen to.

Answer 1

good portswigger.net/burp/

Answer 2

For me, the following tools are not bad at all:
from open source:
w3af
OWASP ZAP
And if it is commercial, then:
Acunetix Web Vulnerability Scanner , but it is under Windows.

Answer 3

nessus, nexpose

Answer 4

Qualys

Answer 5

I recommend paying attention to BackTrack .
This is a distribution for security auditing.

Answer 6

The already mentioned Burp Suite is the best open source solution.

Answer 7

And of course xspider from positive technology )

Answer 8

I worked on one site that was regularly attacked and had to be constantly "raised". I used scanners from Positive Technologies and METASCAN , both are good, but I liked METASCAN more, it had a more understandable interface and a fairly detailed scan report. In addition, I scanned not only for web vulnerabilities, I also checked system vulnerabilities and even, for the sake of interest, tried to brute SSH. In general, I scanned the entire infrastructure and found vulnerabilities in OpenSSH and a couple of pages with XSS, after I corrected everything, the site stopped "falling".