Appendix A: Testing Tools - Revision history

Fabian: /* Open Source / Freeware */

2019-05-07T09:02:17Z

‎Open Source / Freeware

Fabian: /* Commercial */

2019-05-07T09:01:01Z

‎Commercial

Mtesauro: Added a product name to a SAST vendor's company name.

2018-08-23T13:55:25Z

Added a product name to a SAST vendor's company name.

Sam.stepanyan: /* Testing SSL */

2018-07-31T23:48:57Z

‎Testing SSL

Sam.stepanyan: /* Testing SSL */

2018-07-31T23:48:35Z

‎Testing SSL

Peter Mosmans: Minor grammar edits

2018-06-08T04:41:59Z

Minor grammar edits

Ejohn20: /* Open Source / Freeware */ Added puma scan (open source) and puma scan pro

2017-09-29T18:07:59Z

‎Open Source / Freeware: Added puma scan (open source) and puma scan pro

Jonathan Marcil: /* Open Source / Freeware */ added one tool updated one link

2017-08-30T16:20:27Z

‎Open Source / Freeware: added one tool updated one link

Ishan123: Link edit

2017-08-02T08:41:06Z

Link edit

Mmeucci at 09:30, 20 January 2017

2017-01-20T09:30:21Z

@@ Line 192: / Line 192: @@
 * SonarQube - http://sonarqube.org
 * W3af - http://w3af.sourceforge.net/
 ===Commercial ===

@@ Line 195: / Line 195: @@
 ===Commercial ===
 * Armorize CodeSecure - http://www.armorize.com/index.php?link_id=codesecure
 * Parasoft C/C++ test - http://www.parasoft.com/jsp/products/cpptest.jsp/index.htm

@@ Line 199: / Line 199: @@
 * Checkmarx CxSuite  - http://www.checkmarx.com
 * HP Fortify - http://www.hpenterprisesecurity.com/products/hp-fortify-software-security-center/hp-fortify-static-code-analyzer
-* GrammaTech - http://www.grammatech.com
+* GrammaTech CodeSonar - http://www.grammatech.com
 * ITS4 - http://seclab.cs.ucdavis.edu/projects/testing/tools/its4.html
 * Appscan - http://www-01.ibm.com/software/rational/products/appscan/source/

@@ Line 99: / Line 99: @@
 * SSLScan windows - https://github.com/rbsec/sslscan/releases
 * SSLLabs - https://www.ssllabs.com/ssltest/
-* High-Tech Bridge ImmuniWeb SSLScan https://www.htbridge.com/ssl/
+* High-Tech Bridge ImmuniWeb SSLScan - https://www.htbridge.com/ssl/
 ==== Testing for Brute Force Password ====

@@ Line 99: / Line 99: @@
 * SSLScan windows - https://github.com/rbsec/sslscan/releases
 * SSLLabs - https://www.ssllabs.com/ssltest/
 ==== Testing for Brute Force Password ====

@@ Line 19: / Line 19: @@
 ** SPIKE designed to analyze new network protocols for buffer overflows or similar weaknesses. It requires a strong knowledge of C to use and only available for the Linux platform.
 * '''Burp Proxy''' - http://www.portswigger.net/Burp/
-** Burp Proxy is an intercepting proxy server for security testing of web applications it allows Intercepting and modifying all HTTP(S) traffic passing in both directions, it can work with custom SSL certificates and non-proxy-aware clients.
+** Burp Proxy is an intercepting proxy server for security testing of web applications. It allows intercepting and modifying all HTTP(S) traffic passing in both directions. It works with custom SSL certificates as well as non-proxy-aware clients.
 * '''Odysseus Proxy''' - http://www.wastelands.gen.nz/odysseus/
 ** Odysseus is a proxy server, which acts as a man-in-the-middle during an HTTP session. A typical HTTP proxy will relay packets to and from a client browser and a web server. It will intercept an HTTP session's data in either direction.
@@ Line 62: / Line 62: @@
 * '''Subgraph Vega''' - http://www.subgraph.com/products.html
 **Vega is a free and open source scanner and testing platform to test the security of web applications. Vega can help you find and validate SQL Injection, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.
 === Testing for specific vulnerabilities ===

@@ Line 188: / Line 188: @@
 * .NET Security Guard - https://dotnet-security-guard.github.io/
 * Oedipus - http://www.darknet.org.uk/2006/06/oedipus-open-source-web-application-security-analysis/
 * Splint - http://splint.org
 * SonarQube - http://sonarqube.org
@@ Line 202: / Line 203: @@
 * Appscan - http://www-01.ibm.com/software/rational/products/appscan/source/
 * ParaSoft - http://www.parasoft.com
 * Virtual Forge CodeProfiler for ABAP - http://www.virtualforge.de
 * Veracode - http://www.veracode.com

@@ Line 180: / Line 180: @@
 * Boon - http://www.cs.berkeley.edu/~daw/boon
 * FindBugs - http://findbugs.sourceforge.net
-* Find Security Bugs - http://h3xstream.github.io/find-sec-bugs/
+* Find Security Bugs - https://find-sec-bugs.github.io/
 * FlawFinder - http://www.dwheeler.com/flawfinder
 * Google CodeSearchDiggity - http://www.bishopfox.com/resources/tools/google-hacking-diggity/attack-tools/
-* phpcs-security-audit - https://github.com/Pheromone/phpcs-security-audit
+* phpcs-security-audit - https://github.com/FloeDesignTechnologies/phpcs-security-audit
 * PMD - http://pmd.sourceforge.net/
 * Microsoft’s [[FxCop]]
 * Oedipus - http://www.darknet.org.uk/2006/06/oedipus-open-source-web-application-security-analysis/
 * Splint - http://splint.org

@@ Line 56: / Line 56: @@
 * '''Cookie swap''' - https://chrome.google.com/webstore/detail/dffhipnliikkblkhpjapbecpmoilcama?hl=en-US
 ** Swap My Cookies is a session manager, it manages cookies, letting you login on any website with several different accounts.
-* '''Firebug lite for Chrome"" -  https://chrome.google.com/webstore/detail/bmagokdooijbeehmkpknfglimnifench
+* '''Firebug lite for Chrome"" -  https://chrome.google.com/webstore/detail/bmagokdooijbeehmkpknfglimnifench'''
 **Firebug Lite is not a substitute for Firebug, or Chrome Developer Tools. It is a tool to be used in conjunction with these tools. Firebug Lite provides the rich visual representation we are used to see in Firebug when it comes to HTML elements, DOM elements, and Box Model shading. It provides also some cool features like inspecting HTML elements with your mouse, and live editing CSS properties
-* '''Session Manager"" -  https://chrome.google.com/webstore/detail/bbcnbpafconjjigibnhbfmmgdbbkcjfi
+* '''Session Manager"" -  https://chrome.google.com/webstore/detail/bbcnbpafconjjigibnhbfmmgdbbkcjfi'''
 **With Session Manager you can quickly save your current browser state and reload it whenever necessary. You can manage multiple sessions, rename or remove them from the session library. Each session remembers the state of the browser at its creation time, i.e the opened tabs and windows.
 * '''Subgraph Vega''' - http://www.subgraph.com/products.html
@@ Line 155: / Line 155: @@
 * SAINT - http://www.saintcorporation.com/
 * QualysGuard WAS - http://www.qualys.com/enterprises/qualysguard/web-application-scanning/
-* IndusGuard Web - https://www.indusface.com/index.php/products/indusguard-web
+* Indusface WAS- https://www.indusface.com/products/application-security/web-application-scanning
 * Retina Web - http://www.eeye.com/Products/Retina/Web-Security-Scanner.aspx
@@ Line 263: / Line 263: @@
 * Sam Spade - http://www.samspade.org
 * Xenu's Link Sleuth - http://home.snafu.de/tilman/xenulink.html
 [[Category:SAMM-CR-2]]

@@ Line 66: / Line 66: @@
 === Testing for specific vulnerabilities ===
-==== Testing for DOM XSS ====
+==== Testing for JavaScript Security, DOM XSS ====
-* DOMinator Pro - https://dominator.mindedsecurity.com
+* BlueClosure BC Detect - http://www.blueclosure.com