Krusst,
veja se ajuda:
http://sectools.org/web-scanners.html
http://www.windowsecurity.com/software/Web-Application-Security/