Automating VAPT:

Here is a list of some tools that are used for automating VAPT:

• Burp Suite Pro - Complete overall semi-automated VAPT for technical flaws such as SQLi, XSS, Command injection, CSRF, etc.

• Acunetix - Completely automated VAPT with minimal human intervention (like for login pages) for overall bugs - technical or non technical.

• Nikto - Free open-source tool which is a bit old and is mainly used to find configuration issues on the web server.

• OWASP ZAP Proxy - Similar to Burp Suite, but available free of cost.

• Nessus - Completely automated VAPT for network-based and server-based vulnerabilities.

• Metasploit - One of the most widely used free tool containing various semi-automated modules to check for and exploit vulnerabilities.

Since massive amount of research and testing goes into developing these tools, most of these are paid. But, most paid tools also have a free to use alternative. This alternative may not be as user friendly as the paid version and may not generate impressive reports, but they can give you a hint of where to do manual attacks. BurpSuite community version that we have used in this training is a free alternative for the paid version called BurpSuite Pro.