Watchfire's AppScan Tool suite from Watchfire automates web application security testing, produces defect analyses, and offers recommendations for fixing detected security flaws. Assessment module can be used by auditors and compliance officers to conduct comprehensive audits, and to validate compliance with security requirements.
Codenomicon HTTP Test Tool Tool for discovering and eradicating security-related flaws in HTTP implementations via robustness testing. Tool systematically generates very large numbers of protocol messages containing exceptional elements simulating malicious attacks, in order to induce component crashes, hanging, and denial-of-service situations which may affect component/application security. (HTTP implementations may be utilized in web servers, browsers, network appliances, proxies, protocol analyzers, PDAs and cell phones.)
SecurityMetrics Appliance Integrated software and hardware device includes Intrusion Detection and Prevention Systems and Vulnerability Assessment. Operates as a Layer 2 Bridge - no network configuration needed. Automatically downloads latest IDS attack signatures, vulnerability assessment scripts and program enhancements nightly.
Lightning Console Security management tool from Tenable Network Security for multiple security and network administrators across multiple organizations. Scheduled vulnerability scanning, real-time IDS event analysis, asset management, remediation management of vulnerabilities, network topology discovery and organizational executive reporting for hundreds of administrators via easy-to-use web interface.
SARA 'Security Auditor's Research Assistant' Unix-based security analysis tool from Advanced Research Corp. Supports the FBI/SANS Top 20 Consensus; remote self scan and API facilities; plug-in facility for third party apps; SANS/ISTS certified, updated bi-monthly; CVE standards support; based on the SATAN model. Freeware. Also available is 'Tiger Analytical Research Assistant' (TARA), an upgrade to the TAMU 'tiger' program - a set of scripts that scan a Unix system for security problems.
Qualys Free Security Scans Several free security scan services from Qualys, Inc. including SANS/FBI Top 20 Vulnerabilities Scan, network security scan, and browser checkup tool.
Qualys Guard Online service that does remote network security assessments; provides proactive 'Managed Vulnerability Assessment', inside and outside the firewall.
Perimeter Check SecurityMetrics 'Perimeter Check' service analyzes external network devices like servers, websites, firewalls, routers, and more for security vulnerabilities which may lead to interrupted service, data theft or system destruction. Includes instructions to help immediately remedy security problems. Can automatically schedule vulnerability assessment of designated IP addresses during low traffic times.
MacAnalysis Low cost Network Security audit tool from Lagoon Software. Provides detailed reports and vulnerability fix recommendations. MacAnalysis database is updated regularly with a "Vulnerability Update" function to update database of more than 100 new holes per month. Runs on Macintosh, can audit UNIX, Mac, Win servers
STAT Scanner Tool from Harris Corp. for security analysis of Windows/UNIX/Linux and other resources. Utilizes comprehensive updatabale vulnerability databases to automatically detect vulnerabilities. Capabilities include: scan and analyze an entire network domain and/or a single machine, select or ignore specific vulnerabilities via configuration files, analysis reports of vulnerabilities with detailed information relating to the name/description/risk level of each vulnerability, eliminate vulnerabilities using recommended solutions with links to related websites and knowledge-base articles, correct vulnerabilities across the network with 'AutoFix' function, retest corrected vulnerabilities immediately, track vulnerability trends via analyses comparing current and previous assessments, customizable security reports for management and technical personnel.
Nessus Security Scanner Free, open-source remote network security auditing tool, by Renaud Deraison, based on 'never trust the version number' and 'never trust that a given service is listening on the good port'. Nessus is made up of two parts : a server and a client; the server (nessusd) manages the 'attacks', whereas the client is a frontend designed to collect the results. Includes more than 1000 tests in 23 vulnerability categories, and Nessus Attack Scripting Language. Works with a variety of operating systems.
NetRecon Network vulnerability assessment scanner from Symantec. Scans systems and services on the network and safely simulates common intrusion or attack scenarios. Utilizes a root-cause and path-analysis engine to illustrate exact sequence of steps taken to uncover vulnerabilities, enabling identification of exactly where to correct vulnerabilities to enforce corporate security policies. Learns about network as it scans, adapting penetration strategy based on previous results. Customizable reporting. Can scan a variety of operating systems; product runs on Windows.
Secure-Me Automated security test scanning service from Broadbandreports.com for individual machines. Port scans, denial-of-service checks, 45 common web server vulnerability checks, web server requests-per-second benchmark, and a wide variety of other tests. Limited free or full licensed versions available.
SAINT Security Administrator's Integrated Network Tool - Security testing tool from SAINT Corporation. An updated and enhanced version of the SATAN network security testing tool. Updated regularly; CVE compatible. Includes DoS testing, reports specify severity levels of problems. Single machine or full network scans. Also available is 'WebSAINT' self-guided scanning service, and SAINTbox scanner appliance. Runs on many UNIX flavors.
NMap Network Mapper Free open source utility for network exploration or security auditing; designed to rapidly scan large networks or single hosts. Uses raw IP packets in novel ways to determine what hosts are available on the network, what services (ports) they are offering, what operating system (and OS version) they are running, what type of packet filters/firewalls are in use, and many other characteristics. Runs on most flavors of UNIX as well as Windows.
bv-Control for Internet Security Secutiry scanning tool from BindView, includes capabilities for checking and remediation of security problems of servers, workstations, routers, hubs, printers, and any other devices with an IP address on a network. Scans any device on network regardless of platform.
NetIQ Security Analyzer Multi-platform vulnerability scanning and assessment product. Systems are analyzed on demand or at scheduled intervals. Automatic update service allows updating with latest security tests. Includes a Software Developer's Kit to allow custom security test additions. For Windows/Solaris/Linux.
Foundstone Vulnerability management software tools from McAfee/Network Associates can provide comprehensive enterprise vulnerability assessments, remediation information, etc. Available as a hardware appliance, software product, or managed service.
CyberCop ASaP Managed vulnerability assessment service from McAfee/Network Associates. Remotely evaluates security of network perimeter, DMZ and externally visible assets.
CERIAS Security Archive Purdue University's 'Center for Education and Research in Information Assurance and Security' site; 'hotlist' section includes extensive collection of links, organized by subject, to hundreds of security information resources and tools, intrusion detection resources, electronic law, publications, etc. Also includes an FTP site with a large collection of (mostly older) security-related utilities, scanners, intrusion detection tools, etc.
InternetScanner Tool from Internet Security Systems, provides automated vulnerability assessment for measuring online security risks. Performs scheduled and selective probes of network services, servers, desktops, operating systems, routers, firewalls, etc. to uncover and report systems vulnerabilities that might be open to attack. Provides flexible risk management reports, prepares remediation advice, trend analyses and comprehensive data sets to support policy enforcement. Similar managed service also available.
Top 75 Security Tools Listing of 'top 75' network security tools from survey by Insecure.org. (Includes various types of security tools, not just for testing.)