- Sep 8, 2022
- 203
- 71
I've been interested in monitoring tools for a long time. You could say it's part of my job, as I'm involved in a SaaS project of this kind. Now I want to give you a list that I think you'll find useful. With this list, you can audit your website's security issues.
By the way, a small note... None of the tools I tried to add to the list are paid. I believe we should support all initiatives that offer Open Source and completely free tools.
OWASP ZAP (Zed Attack Proxy) ( https://www.zaproxy.org/ ) A powerful open-source tool from the Open Web Application Security Project (OWASP). It's great for finding common vulnerabilities like XSS and SQL Injection. ZAP works as a proxy to intercept traffic and has both automated scanning for beginners and advanced features for manual penetration testing.
Nikto: ( https://github.com/sullo/nikto ) This is a classic open-source web server scanner. Nikto checks for thousands of potentially dangerous files, outdated server versions, and other common security misconfigurations. It's a fantastic tool for getting a quick overview of your server's security health from an external perspective.
Qualys SSL Labs SSL Test ( https://www.ssllabs.com/ssltest/ ) A must-use free online service for anyone running a website on HTTPS. It performs a deep analysis of your SSL/TLS certificate configuration and grades it from A+ to F. It helps you identify weak ciphers, incorrect certificate chains, and other issues that could make your secure connection vulnerable.
Sucuri SiteCheck A popular free online scanner that checks your website for known malware, blacklist status, and common security issues. It's a very quick way to see if your site has been flagged by major security authorities or if it contains malicious code.
OpenVAS (Greenbone Vulnerability Manager) For those who want a more comprehensive and self-hosted solution, OpenVAS (now part of Greenbone Vulnerability Manager's free community edition) is a full-featured vulnerability scanner. It goes beyond web applications to check your network and server infrastructure for a wide range of security risks using a regularly updated feed of tests.
For those who are a bit more professional or want a more detailed list, you can also check the list here. I generally got these tools from there as well.
By the way, a small note... None of the tools I tried to add to the list are paid. I believe we should support all initiatives that offer Open Source and completely free tools.
OWASP ZAP (Zed Attack Proxy) ( https://www.zaproxy.org/ ) A powerful open-source tool from the Open Web Application Security Project (OWASP). It's great for finding common vulnerabilities like XSS and SQL Injection. ZAP works as a proxy to intercept traffic and has both automated scanning for beginners and advanced features for manual penetration testing.
Nikto: ( https://github.com/sullo/nikto ) This is a classic open-source web server scanner. Nikto checks for thousands of potentially dangerous files, outdated server versions, and other common security misconfigurations. It's a fantastic tool for getting a quick overview of your server's security health from an external perspective.
Qualys SSL Labs SSL Test ( https://www.ssllabs.com/ssltest/ ) A must-use free online service for anyone running a website on HTTPS. It performs a deep analysis of your SSL/TLS certificate configuration and grades it from A+ to F. It helps you identify weak ciphers, incorrect certificate chains, and other issues that could make your secure connection vulnerable.
Sucuri SiteCheck A popular free online scanner that checks your website for known malware, blacklist status, and common security issues. It's a very quick way to see if your site has been flagged by major security authorities or if it contains malicious code.
OpenVAS (Greenbone Vulnerability Manager) For those who want a more comprehensive and self-hosted solution, OpenVAS (now part of Greenbone Vulnerability Manager's free community edition) is a full-featured vulnerability scanner. It goes beyond web applications to check your network and server infrastructure for a wide range of security risks using a regularly updated feed of tests.
For those who are a bit more professional or want a more detailed list, you can also check the list here. I generally got these tools from there as well.
