w3af is a powerful tool, but works better in conjunction with the following tools:
- Nmap (http://nmap.org/): A simple to use, highly popular, award-winning network scanner.
- Nikto (http://cirt.net/nikto2): A Perl script that quickly summarizes system details and looks for the most obvious defects.
- Skipfish (https://code.google.com/p/skipfish/downloads/list): A C program that bashes away at many requests over a prolonged period. You can choose from different dictionaries of attacks. This is an excellent poor man's stress test; if your system stays up, you know that it has reached a minimal level of stability.
- Wapiti (http://wapiti.sourceforge.net/): A Python-based script that discovers attackable URLs and then cycles ...