> For the complete documentation index, see [llms.txt](https://notes.carpa-sec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.carpa-sec.com/offensive-security/reconnaissance-and-information-gathering/active-recon/web-application/automated-vulnerability-scanning.md).

# Automated Vulnerability Scanning

Automated Vulnerability Scanning is a critical component of active web application reconnaissance, allowing for the efficient identification of known vulnerabilities in web applications. 

{% embed url="<https://www.youtube.com/watch?pp=ygUmd2ViIGFwcGxpY2F0aW9uIHZ1bG5lcmFiaWxpdHkgc2Nhbm5lciA=&v=fG7HhqEJbTs>" %}

OWASP ZAP (Zed Attack Proxy)**:** Automated vulnerability scanner for web applications.

{% embed url="<https://www.youtube.com/watch?pp=ygUmd2ViIGFwcGxpY2F0aW9uIHZ1bG5lcmFiaWxpdHkgc2Nhbm5lciA=&v=Uv6Idf5ZB9c>" %}

Nessus: Widely used vulnerability scanner with web application scanning capabilities.

[Acunetix](https://www.acunetix.com/)**:** Automated tool to scan web applications for vulnerabilities.

Nikto (CLI-based)**:** Web server scanner which performs tests against web servers for multiple items.

```bash
nikto -h http://example.com
# Scans the specified website.
nikto -h http://example.com -ssl
# Scans using SSL.
nikto -update
# Updates Nikto’s plugin and database.
nikto -h http://example.com -output results.html
# Outputs the results to an HTML file.
nikto -h http://example.com -port 8080
# Scans a specific port.
```

{% embed url="<https://www.youtube.com/watch?pp=ygUmd2ViIGFwcGxpY2F0aW9uIHZ1bG5lcmFiaWxpdHkgc2Nhbm5lciA=&v=K78YOmbuT48>" %}

Qualys Web Application Scannin&#x67;**:** Cloud service for automated web application scanning.

SQLmap (CLI-based)**:** Automated tool for SQL injection discovery and exploitation.

```bash
sqlmap -u http://example.com --batch
# Runs SQLmap in batch mode.
sqlmap -u http://example.com --forms
# Scans web forms.
sqlmap -u http://example.com --dbs
# Enumerates DBMS databases.
sqlmap -u http://example.com -D dbname --tables
# Lists tables in a specific database.
sqlmap -u http://example.com -D dbname -T tablename --dump
# Dumps the contents of a specific table.
```

WebInspec&#x74;**:** Automated dynamic application security testing.

AppSpide&#x72;**:** Scans web applications to identify vulnerabilities.

[W3af](https://www.w3af.org/)**:** Web application attack and audit framework.

IBM Security AppSca&#x6E;**:** Suite of software products for security testing of web applications.

[Detectify](https://detectify.com/): Automated vulnerability scanner that mimics a hacker's techniques.

[Netsparker](https://www.netsparker.com/)**:** Automated web application security testing.

Veracode Static Analysi&#x73;**:** Identifies and fixes vulnerabilities in web applications in all major languages.

[Probely](https://probely.com/)**:** Finds vulnerabilities and provides guidance on fixing them.

[Invicti ](https://www.invicti.com/)(Formerly NetSparker)**:** Scans web applications, websites, and web services to detect security flaws.

[SiteLock](https://www.sitelock.com/)**:** Provides website scanning and malware detection.

[Syhunt](https://www.syhunt.com/)**:** A suite of tools for dynamic and static analysis of web applications.

BeEF (Browser Exploitation Framework)**:** Focuses on the web browser, aiming to assess the security posture of a target environment.

Grabbe&#x72;**:** Scans small web applications for common vulnerabilities.

{% embed url="<https://www.youtube.com/watch?t=295s&v=EcmVKeakXfA>" %}