Question: what tools are used for web application penetration testing?
Answer: Arachni. Apt for both penetration testers and admins, Arachni is designed to identify security issues within a web application. ... 
Grabber. The portable Grabber is designed to scan small web applications, including forums and personal websites. ... 
Iron Wasp. ... 
Nogotofail. ... 
SonarQube. ... 
SQLMap. ... 
W3af. ... 
Wapiti.