[Redshadow]

Hello everyone. I'm new to this beautiful forum. Don't rage if am wrong, thank you!

Just wondering, is there a free or paid automated tool to exploit OWASP 10 vulns on website?

Leave a reply, thanks for reading this thread.

[bass booster]

So you want to use a test hack site with automated tool?
I smell a skid
#skidalert

[SirNoobHack]

So you want to use a test hack site with automated tool?
I smell a skid
#skidalert

Probably, yes. OP you shouldn't try to exploit something if you don't know how and what it exploits.

[.aaim]

Hello everyone. I'm new to this beautiful forum. Don't rage if am wrong, thank you!

Just wondering, is there a free or paid automated tool to exploit OWASP 10 vulns on website?

Leave a reply, thanks for reading this thread.

There are automation tools like OWASP ZAP, Acunetix, Netsparker, which can automate the scan.But there are high chances of false negative. So its advised try to learn manual testing and understand the working of application to exploit. Try exploiting vulnerable machine on site like vulnhub.

[Redshadow]

There are automation tools like OWASP ZAP, Acunetix, Netsparker, which can automate the scan.But there are high chances of false negative. So its advised try to learn manual testing and understand the working of application to exploit. Try exploiting vulnerable machine on site like vulnhub.

Thanks for the advise man. Don't rage at my question. Do you know of any OWASP 10 vulns exploit tool like W3af?

[.aaim]

Thanks for the advise man. Don't rage at my question. Do you know of any OWASP 10 vulns exploit tool like W3af?

I have already mentioned them. OWASP ZAP is the project of OWASP community only and is open source, so you can try that.

Try to search for OWASP top 10 searching tools. will surely give you list of different free and good tools with their advantages/disadvantages.

Also try to follow OWASP top 10 testing guide 4.0. Which mentions different vulnerabilities and how to test them manually or by using automated tools. Hope the following link will help you.

https www(dot)owasp(dot)org/index(dot)php/ZAPpingTheTop10

[Redshadow]

I have already mentioned them. OWASP ZAP is the project of OWASP community only and is open source, so you can try that.

Try to search for OWASP top 10 searching tools. will surely give you list of different free and good tools with their advantages/disadvantages.

Also try to follow OWASP top 10 testing guide 4.0. Which mentions different vulnerabilities and how to test them manually or by using automated tools. Hope the following link will help you.

https www(dot)owasp(dot)org/index(dot)php/ZAPpingTheTop10

Thanks man, I will do more research on this but for now, I just finished scanning a website with OWASP ZAP in Kali Linux 2.0.

Vulns Discovered Are:

1. Secure Page Includes Mixed Content Including Script

2. X-Frame-Options Header Not Set

3. Cookie Set Without Secure Flag

4. Cross-Domain Javascript Sources File Inclusion

5. Incomplete Or No Cache-Control And Pragma HTTP Header Set

6. Secure Page Includes Mixed Content

7. Web Browser XSS Protection Not Enabled

8. X-Content-Type-Options Header Missing

How do I go about exploiting these vulns found in OWASP ZAP scan results?

For now, I can only exploit sql injection vulns. Please don't be angry by my ignorant. I am new here!