Web Security Tools
Overview
The core toolset for testing and securing web applications, organized by where in the process each one is used.
Key concepts
- Proxy/testing: Burp Suite, OWASP ZAP
- Scanning: Nikto, Nmap, Nessus
- Development: WAF, SAST, DAST, SCA
Tools & techniques
| Tool | Purpose | When to use |
|---|---|---|
| Burp Suite | Inspect/modify/test web traffic | Manual web app testing |
| OWASP ZAP | Automated web vulnerability scanning | Broad web app assessments |
| Nikto | Web server misconfiguration scanning | Server-level checks |
How it works
Proxy & testing tools
| Tool | Purpose |
|---|---|
| Burp Suite | Inspects, modifies, and tests web application traffic. |
| OWASP ZAP | Identifies common web application security weaknesses. |
| Browser developer tools | Built-in tools to inspect webpages, storage, requests, responses, and scripts. |
Scanning tools
| Tool | Purpose |
|---|---|
| Nikto | Identifies insecure files, configurations, and outdated components on web servers. |
| Nmap | Identifies open ports and web-related services. |
| Nessus | Identifies known weaknesses and missing patches. |
Development-side tools
| Tool/Practice | Purpose |
|---|---|
| Web application firewall (WAF) | Monitors and filters HTTP/HTTPS traffic to a web application. |
| Static application security testing (SAST) | Analyzes source code for security weaknesses without running the application. |
| Dynamic application security testing (DAST) | Tests a running web application for security weaknesses. |
| Software composition analysis (SCA) | Identifies third-party libraries and known vulnerabilities in dependencies. |