Services · Unknown vulnerabilities

General-purpose web scanners

These tools crawl your site and test its own code (forms, parameters, sessions, headers) for flaws no public database knows about yet. They find what you built that an attacker could turn against you.

What you get: Custom-code vulnerabilities (injection, XSS, auth flaws, misconfig). 5 tools

OWASP ZAP

★ Featured

The most widely used open-source web application scanner.

Findings + severity Best for: Any web app

View details

Wapiti

Black-box scanner that audits your site by injecting real payloads.

Injection findings Best for: Form-heavy sites

View details

Skipfish

High-speed active reconnaissance and security probe.

Sitemap + issues Best for: Large sites

View details

Vega

GUI-driven scanner and intercepting proxy in one.

Alerts + evidence Best for: Manual review

View details

Arachni

Feature-rich scanner that understands modern, JavaScript-heavy apps.

Findings + proof Best for: Dynamic apps

View details

We'll help you pick the right scan.

Tell us about your site and we'll point you to the right starting place.

Get a scan