There are several different directions that you can use with automated testing tools for web applications.
First, there are commercial web scanners , among which the most popular are HP WebInspect and Rational AppScan. These are all-in-one, fire and swelling tools that you download and install on your Windows internal desktop, and then specify the URL for your site's spider, scanning for known vulnerabilities (i.e., Things that hit at Bugtraq) and investigated cross-site scripting and SQL injection vulnerabilities.
Secondly, source code scanning tools exist, of which Coverity and Fortify are probably the two best known. These are the tools that you install on the developer's desktop to process your Java or C # source code and look for known patterns of unsafe code, such as poor input validation.
Finally, there are tools for penetration testing . The most popular application penetration testing tool among security professionals is the Burp Suite, which you can find at http://www.portswigger.net/proxy . Others include Spike Proxy and OWASP WebScarab. Again, you install it on your Windows internal desktop. It will act as an HTTP proxy, and you point your browser to it. You will use your applications as a regular user, while he logs your actions. You can then go back to each individual page or HTTP action and examine it for security issues.
In a complex environment, and especially if you are considering DIY , I highly recommend penetration testing tools . That's why:
Commercial web crawlers provide many latitudes, as well as excellent reporting. However:
They tend to skip things because every application is different.
They are expensive (WebInspect starts at 10,000).
You pay for things you don’t need (for example, databases of known bad CGIs from the 90s).
They are hard to set up.
They can create noisy results.
Source code scanners are more thorough than web scanners. However:
They are even more expensive than web crawlers.
They need the source code.
To be effective, they often require you to annotate the source code (for example, to select input paths).
They have a tendency to create false positives.
Both commercial and source code scanners have a bad habit of becoming shelves. Worse, even if they work, their cost is comparable to getting 1 or 2 whole applications verified by a consultant; if you trust your consultants, you are guaranteed to get better results from them than from tools.
Penetration testing tools also have disadvantages:
They are much more difficult to use than commercial scanners with automatic shutdown and forget.
They imply some experience in web application vulnerabilities - you should know what you are looking for.
They do not produce little or no formal reporting.
On the other hand:
They are much, much cheaper --- the best of the many, Burp Suite, costs only 99EU and has a free version.
They are easy to configure and add to the testing workflow.
They help you much better “know” your applications from the inside.
Here you can do something with the pen test tool for a basic web application:
Log in to the application through a proxy
Create a hit list of the main functional areas of the application and execute each time.
Use the spider tool in your pen test application to find all the pages and actions and handlers in the application.
For each dynamic page and each HTML form that the spider opens, use the "fuzzer" tool (Burp calls it the "intruder") to use each parameter with invalid inputs. Most fuzzers come with basic test lines, which include:
SQL metacharacters
HTML / Javascript Expressions and Metacharacters
Their internationalized options for evading input filters
Known default form field names and values
Known directory names, file names, and handler verbs
Spend several hours filtering your errors (a typical fuzz run for one form can generate 1000 of them) looking for suspicious answers.
This is a time consuming, “bare” approach. But when your company owns real applications, the “pure metal” principle pays off because you can use it to create sets of regression tests that will work like clocks in each dev graph for each application. This is a gain for a number of reasons:
Security testing will require a predictable amount of time and resources for each application, which allows you to plan and sort.
Your team will get the most accurate and complete results, as your testing will be tuned to your applications.
It will cost less than commercial scanners and fewer consultants.
Of course, if you go this route, you basically turn into a security consultant for your company. I do not think this is bad. if you do not want this experience, WebInspect or Fortify will not help you in any way.