https://www.rapid7.com/products/nexpose/download/
OpenVAS
OpenVAS is a general vulnerability assessment tool that touts itself as the world’s most advanced open source vulnerability scanner and manager. It is a fork of the previously open source Nessus vulnerability scanner. The scan engine is updated daily with new network vulnerability tests (NVTs), the equivalent of virus signatures, and there are currently well over 35,000 in total.
Nexpose Community
Another general open source vulnerability assessment tool, Nexpose vulnerability engine developed by Rapid7 scans for almost 68,000 vulnerabilities and makes over 163,000 network checks. The Community edition for Windows or Linux is free, though it is limited to 32 IP addresses and one user. Although it lacks Web application scanning, it includes automatic vulnerability updates and Microsoft Patch Tuesday vulnerability updates.h
Metasploit Framework
Metasploit Framework is an open source penetration testing framework which works hand in hand with Nexpose. It can be used to validate vulnerabilities found by Nexpose and enables the prioritizing of exploitable vulnerabilities for patching or mitigation.
The open source Metasploit Framework is a command line only tool. Metasploit Community is a free non-open source version, which is easier to use thanks to a Web UI.
http://info.beyondtrust.com/cscommunity
Retina CS Community
Another general open source vulnerability assessment tool, Retina CS Community is a Web-based console that simplifies and centralizes vulnerability management and patching for up to 256 assets at no cost. It includes automated vulnerability assessment for servers, workstations, mobile devices, databases, applications and Web applications.
The open source application offers full support for VMware environments, including online and offline virtual image scanning, virtual application scanning, and integration with vCenter.
Burp Suite Free Edition
An open source Web application vulnerability scanner, Burp Suite Free Edition is a software toolkit that contains everything needed to carry out manual security testing of Web applications. It enables inspection and modification of traffic between the browser and the target application, using the intercepting proxy; crawling application content and functionality, with the application-aware Spider; manipulation and resending of individual requests, using the Repeater tool; and access to a selection of utilities for analyzing and decoding application data.
Nikto
Nikto is an open source Web server scanner which performs comprehensive tests against Web servers for multiple items, including over 6,700 potentially dangerous files/programs. It also checks for outdated versions of over 1,250 servers and version specific problems on over 270 servers.
Plus, it checks for server configuration items such as the presence of multiple index files and HTTP server options, and it will attempt to identify installed Web servers and software. Scan items and plugins are frequently updated and can be updated automatically.
OWASP Zed Attack Proxy (ZAP)
The OWASP Zed Attack Proxy (ZAP) is an integrated tool for finding vulnerabilities in Web applications.
A fork of the Paros Proxy tool, ZAP provides automated scanners as well as a set of tools for finding security vulnerabilities manually. The open source tool is under active development, supported by organizations including OWASP, Microsoft and Google.
Clair
Clair is a specialized container vulnerability analysis service. It provides a list of vulnerabilities that may threaten a container and can notify users when new vulnerabilities that affect existing containers become known.
Clair analyzes each container layer once and does not execute the container to perform its examination. The open source scanning engine extracts all required data to detect known vulnerabilities and caches layer data for examination against vulnerabilities discovered in the future.
Moloch
Moloch is an open source, large scale IPv4 packet capturing (PCAP), indexing and database system. A simple Web interface is provided for PCAP browsing, searching and exporting.
Moloch is not meant to replace IDS engines but instead to work alongside them to store and index all the network traffic in standard PCAP format, providing fast access. The open source analysis tool is built to be deployed across many systems and can scale to handle multiple gigabits/sec of traffic.
Powerfuzzer
Powerfuzzer is a highly automated and fully customizable Web fuzzer (HTTP protocol-based application fuzzer). The open source tool is capable of identifying these problems: cross site scripting (XSS); injections (SQL, LDAP, code, commands, CRLF and XPATH); and HTTP 500 statuses (usually indicative of a possible misconfiguration/security flaw such as buffer overflow).