You can find some interesting projects on tools for VAPT on the OWASP website, or in the Tools section
of the Kali Linux website.
A first type of tools that can be used are programs for crawling web applications, they allow you
to download the entire structure of a website locally.
Among these tools we can mention, for example, the wget command line program or the HTTrack
application.
At the end of this operation, the tester will be able to conveniently check the client-side source code
of all pages in search of vulnerabilities, or sensitive data, and will also have a look at the structure
of the site in terms of virtual directory.
Another type of useful tools for VAPTs, are proxies such as Fiddler, Burp or WebScarab.
They allow intercepting requests to bypass any input validation carried out on the pages with client
side technology such as JavaScript, Jquery, Angular and check whether server side a further data validation
is carried out.
This is a screenshot of the Burp Suite, which is not only a proxy, but a more complete application,
which in the professional version also adds a Web application vulnerability scanner functionality.
We also have tools that work as vulnerability scanners, among them
there are vulnerability scanners at the Web server level, such as Nikto, able to detect incorrect
configuration on the Web servers.
Then there are general purpose vulnerability scanners that are potentially capable of detecting vulnerabilities
of the most disparate targets, such as applications, operating systems, services, network devices.
At the end of the scan, they generate reports that list the vulnerabilities found on the target, classifying
them typically by criticality.
One of the most well-known critical encodings is the CVSS standard common vulnerabilities
scoring system.
Among these vulnerability scanners, for example, Tenable Nessus can be mentioned.
Greenbone Security's OpenVas is another known general-purpose vulnerability scanner.
Rapid7's Nexpose is also a famous vulnerability scanner
Another known general-purpose vulnerability scanner is the Qualys vulnerability scanner.
There are also specific vulnerability scanners for finding vulnerabilities on web applications,
also known as dynamic application security testing tools, or DAST tools as, for example, Acunetix
and Netsparker.
Owasp has developed an open source Web application vulnerability scanner known as ZAP Zed Attack Proxy,
which can be downloaded by accessing the Owasp ZAP project section.
There are also suites that work not only as DAST tools, but also as SAST tools or static application
security testing tools, which can also allow you to perform a static analysis of the source code of
the Web application.
Among this, it is worth mentioning the WebInspect/Fortify suite and the AppScan suite.
And finally, there are specific vulnerability scanners for Web applications developed with CMS
such as Joomla or WordPress, among which we can mention, for example, the Joomscan or WPscan
tools, both included among the tools of the Kali Linux distribution.
Moving on from the vulnerability assessment, which only highlights vulnerabilities without exploiting
them to the Pentest, which instead attempts to exploit vulnerabilities through exploits, we can
mention framework that allows you to automate Pentests such as
Core Impact of Core Security
A very famous platform for Pentest automation, is Rapid7's Metasploit, which also exist in
the community version included in Kali Linux.
Immunity's Canvas can also be mentioned among the Pentest frameworks.
This slide shows a list of the most frequent and common attacks on applications and web targets.
Here I've shown in the form of a diagram, all the possible sequential steps to be performed to carry
out Pentest of Web applications.
To carry out VAPTs simulations, various application projects developed with various technologies can
be found on the Web, they can be used to perform test laboratories. Owasp has also developped a
project called WebGoat, a Web application in PHP to run Pentest laboratories.
You can also use for testing purposes for VAPT, a project of an application I developed with ASP.NET
called VVWA, downloadable from GitHub
Thank you for your kind attention.