title: Advice on code scanning / penetration testing tools
body: <p>As far as I can see the offerings fall into two categories – scanning services such as McAfee, Comodo, etc. and tools such as Burp Proxy, HP’s WebInspect,CodeScan, etc. </p>
  
  <p>In an ideal world, I’d use something that actively scanned a certain URL (the target being a LAMP stack) on a daily basis (or as required if it’s a standalone tool), but I’m a bit wary of standalone tools in terms of their coverage and frequency of updating. (The ‘remote’ scanners such as McAfee are presumably updated as required.) </p>
  
  <p>I’ve also had issues with some standalone tools (can’t remember which one unfortunately) that managed to get themselves lost within our URL rewriting system (there’s a facetted search in play, so you can imagine things get fairly deep on the URL front).</p>
  
  <p>As such, I’m just wondering what experiences people have had with the offerings out there and whether the standalone tools stack up against the scanning services.</p>
  
  <p>(Incidentally, I'm aware of <a href="https://stackoverflow.com/questions/72166/penetration-testing-tools">Penetration testing tools</a> - I'm just wondering if the situation has changed since then)</p>