I'm looking for a new tool for the ol' admin toolkit and would value some suggestions.
I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along with checking for SQL injection opportunities. I realize that an automated tool approach isn't necessarily the only or best solution, but I'm hoping it would give me a nice start.
The sites I need to scan cover the range in stacks from PHP / MySQL to Coldfusion, with some classic ASP and ASP.NET mixed in for good measure.
What tools would you use to scan for Web application vulns?
(Please note I'm focusing on the web apps directly, not the servers themselves).