Acunetix is alright for quick n' dirty scanning.
The main issue with some of these scanners are just like you said false positives
And theyre noisy, branding themselves in the USER_AGENT field and spamming the httpd access.log file with a bunch of polluted parameters.
Some other options are: Netsparker (Less Noisy than Acunetix, but less accurate)
w3af (Open Source, More accuract than Acunetix/Netsparker)
Skipfish
Vanguard (This is made by blackhat academy, there's a public/private version, the public version doesnt crawl AJAX or generate the exploit payloads for you.)
The main issue with some of these scanners are just like you said false positives
And theyre noisy, branding themselves in the USER_AGENT field and spamming the httpd access.log file with a bunch of polluted parameters.
Some other options are: Netsparker (Less Noisy than Acunetix, but less accurate)
w3af (Open Source, More accuract than Acunetix/Netsparker)
Skipfish
Vanguard (This is made by blackhat academy, there's a public/private version, the public version doesnt crawl AJAX or generate the exploit payloads for you.)
