There's several free/open source options out there. A close friend of mine who's a Web applications pen tester uses none of these (with exception to Nessus, but only the Professional Feed) as their toolset is quite a bit more sophisticated and contains many unpublished zero day exploits. However, they're very expensive and require certain certifications/qualifications to purchase.
While these tools may not be on the bleeding edge as far as pure, zero-day vulnerability scanning goes, there's still alot of older, well-known vulnerabilities that are exploited daily, so this will certainly give you a pretty good idea of what's potentially vulnerable on your system, exploit or not (i.e. finding unscrubbed parameters, any misconfigurations, etc.).
Couple of things that you may not be aware:
- Full scans can take days sometimes weeks to complete, depending on the size of the site, the network (see below), and the breadth/depth of scan rules Plan accordingly.
Some of the scanners have throttling features but because of the sheer volume of requests, it's better to:
a) test your Web application on a fast network (LAN);
b) obviously this Web application shouldn't be in production and if so, I'd be running it with a test data set;
c) have plenty of resources for logging (or disable it altogether).
You may also want to periodically check the online vulnerability databases for known exploits out there; I do a periodic search for any open source Web applications I'm hosting and disable or patch as required (I'm looking at you Joomla).