Vega

What Vega is

Vega is a free, Java-based graphical platform for testing web application security. It runs on Linux, macOS, and Windows and is deployed on-premise, but Subgraph says the software is discontinued. Its scanner crawls websites within a configured scope, processes forms, identifies possible injection points, and runs modules that can test for issues such as cross-site scripting and SQL injection. An intercepting proxy lets users inspect, pause, and edit browser requests and server responses. While users browse pages in scope through the proxy, Vega can fuzz parameters and actively test those pages. Scans support HTTP Basic, HTTP Digest, NTLM, and macro-based form authentication, plus configured cookies; proxy scanning can use client cookies to preserve authenticated sessions. JavaScript modules can extend active fuzzing and response processing, and can generate XML-based alerts. Scope settings allow multiple base URIs and exclusions, and preferences include crawl and request-rate controls. For HTTPS inspection, Vega creates replacement certificates that can be imported into a browser. Its documentation advises using the scanner only on servers owned by the user and not in production.