Web Application Analysis
Application-layer testing: injection flaws, authentication weaknesses, and systematic fuzzing of endpoints and parameters most network-level scanners never look at.
| Tool | Source | Notes |
|---|---|---|
| sqlmap | official | SQL injection |
| wpscan | official | WordPress scanner |
| burpsuite | aur | Web proxy/intercept suite |
| caido-desktop | aur | Web security auditing (Burp alternative) |
| wfuzz | aur | Web application fuzzer (includes a GUI mode, wxfuzz) |
SSL Labs rounds this category out for TLS/certificate configuration checks that don’t need a local tool at all.