Which free and open-source web security scanner helps find SQL injection and XSS vulnerabilities in web applications?

• A. Intercepting Traffic from Browser Extensions
• B. WhatWeb
• C. Vega
• D. SAML messages

Answer: (C)

Testing for SQL injection and XSS involves using a tool that automatically probes a web application’s inputs and responses to uncover security weaknesses. Vega is a free, open-source web vulnerability scanner designed for this purpose. It can crawl a website, submit crafted inputs to forms and parameters, analyze how the application handles those inputs, and report findings such as SQL injection and cross-site scripting vulnerabilities. It provides both automated scanning and a graphical interface for manual exploration, and being Java-based, it runs on multiple platforms with an open-source license that allows customization.

Interpreting the other options, intercepting traffic from browser extensions focuses on capturing or modifying HTTP traffic rather than performing automated vulnerability checks. WhatWeb is a fingerprinting tool used to identify technologies a site runs, not to detect security flaws. SAML messages relate to the authentication protocol, not to vulnerability scanning. Vega uniquely matches the goal of finding SQL injection and XSS in web applications.