wapiti vulnerability scanner
iSpeech
The web-application vulnerability scanner
Wapiti allows you to audit the security of your websites or web applications.
Wapiti can detect the following vulnerabilities :
File disclosure (Local and remote include/require, fopen, readfile...)
Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
XSS (Cross Site Scripting) injection (reflected and permanent)
Command Execution detection (eval(), system(), passtru()...)
CRLF Injection (HTTP Response Splitting, session fixation...)
XXE (XML External Entity) injection
SSRF (Server Side Request Forgery)
Use of know potentially dangerous files (thanks to the Nikto database)
Weak .htaccess configurations that can be bypassed
Presence of backup files giving sensitive information (source code disclosure)
Shellshock (aka Bash bug)
source
Gloss