So far in the book, we have not specifically set a topic point on tools. We have, for the most part, remained process-centric and discussed some tools within each chapter. For web application testing, this is a different matter. As you have seen throughout this chapter, there are many varieties of input and ways to interact with web applications, and this is the challenge with this form of testing. Therefore, it is usually best handled with tools to get the bulk data and then manually go and investigate areas of interest for the bulk data. There are a large number of tools out there, and we will not go through them here.

One of the tools that we like to use that has both a free version and a commercial version is Burp Suite. We like it because it allows us to do a wide variety of things when we are testing, and we also like the fact that the commercial version is a very reasonable price. You can find information about the tool at http://www.portswigger.net. The free version can also...