---
title: "Web Application Tools"
description: "TurboPentest's web application testing tools - the DAST scanners that probe your app for OWASP Top 10 and other vulnerabilities."
canonical: https://turbopentest.com/docs/tools/web-app-tools
source: "TurboPentest Docs"
---

# Web Application Tools

## 🕸️ Web Scanner

Comprehensive web application security testing (DAST) engine.

**What it finds:**
- Cross-site scripting (XSS)
- SQL injection
- Cross-site request forgery (CSRF)
- Security misconfigurations
- Information disclosure
- Authentication issues

## 🎯 Vuln Scanner

Template-based vulnerability detection engine with 8,000+ templates.

**What it finds:**
- Known CVEs in web frameworks and CMS
- Exposed configuration files
- Default credentials
- API key leaks in responses
- Technology-specific misconfigurations

## 🔍 Server Audit

Web server assessment engine.

**What it finds:**
- Dangerous default files (`/phpinfo.php`, `/.env`, etc.)
- Outdated server software
- Server misconfigurations
- Common CGI vulnerabilities

## 📂 Enumerator

Fast web fuzzer for content discovery.

**What it finds:**
- Hidden directories and files
- Backup files (`.bak`, `.old`, `.sql`)
- Admin panels
- API endpoints not linked from the main application

## 🛡️ Net Scanner

Full-featured network vulnerability assessment system.

**What it finds:**
- Network vulnerabilities across all protocols
- Missing patches
- Service-level vulnerabilities
- Compliance checks

## 🔧 Security Checks

IntegSec's custom vulnerability toolkit.

**What it finds:**
- Additional checks that complement the other Turbo scanners
- Web application vulnerabilities
- Infrastructure issues