OWASP ZAP
OWASP ZAP Security Testing: Automated Web Application Scanning
OWASP ZAP (Zed Attack Proxy) is the most widely used open-source web application security scanner. It acts as a proxy between your browser and the target application, passively scanning traffic for vulnerabilities. It also has an active scanner that sends attack payloads to find SQL injection, XSS, CSRF, and