Freedom251 › Web Application Security Scanners
Vega
What Vega is
Vega is a free, Java-based graphical platform for testing web application security. Developed by Subgraph, it runs on Linux, macOS, and Windows and is deployed on-premise. Subgraph says the software is discontinued. Its automated scanner crawls websites, follows links within the configured target scope, processes forms, and looks for possible injection points. Modules can test for issues such as cross-site scripting and SQL injection. Users can also route browsing through Vega’s intercepting proxy to inspect, pause, and edit browser requests and server responses. While visiting pages in scope, the proxy scanner can fuzz parameters and actively test them. Scans support HTTP Basic, HTTP Digest, NTLM, and macro-based form authentication, as well as configured cookies; proxy scans can use client cookies to maintain authenticated sessions. Scope settings allow multiple base URIs and exclusions, and scanner preferences include crawl and request-rate controls. JavaScript modules can extend fuzzing and response processing, and may produce XML alerts. For HTTPS inspection, Vega creates replacement certificates that can be imported into a browser. Its documentation advises using it on servers you own that are not in production.
Who it suits
Vega may suit security practitioners who need a graphical, on-premise tool for crawling and testing web applications across Linux, macOS, or Windows. Its authentication options, proxy scanning, and configurable scope are relevant to testing sites with authenticated areas.
What it does well
- Free to use.
- Runs on Linux, macOS, and Windows.
- Supports several forms of authenticated scanning.
- Combines automated crawling with proxy-based testing.
- JavaScript modules can extend scanning and response processing.
What to know first
- Subgraph says Vega is discontinued.
- The documentation advises against experimenting on production servers.
Limits
Vega is discontinued. Its documentation advises experimenting only on servers owned by the user and not in production.
Getting started
- Visit the Vega website for downloads and documentation.
- Choose the version for Linux, macOS, or Windows.
- Install and run Vega on a system you manage.
- Configure target scope and scan preferences before scanning.
- Use it only on servers you own that are not in production.
Verdict
Vega may suit users seeking a free graphical web application scanner with proxy and authenticated scanning options. Its discontinued status is a key reason to look elsewhere if ongoing development is important.
Questions
Is Vega free?
Yes. Vega is listed as free, with a free plan.
Which operating systems does Vega support?
Linux, macOS, and Windows.
Is Vega still being developed?
Subgraph says Vega is discontinued.
Can Vega scan authenticated areas?
Yes. Automated scans support HTTP Basic, HTTP Digest, NTLM, and macro-based form authentication. Proxy scans can use client cookies to preserve authenticated sessions.
Who makes Vega?
Vega is developed by Subgraph, an open source security startup based in Montreal, Canada.
Facts from Vega's own pages
- Alerts
- Scanner modules can generate XML-based alerts, with links to saved requests and responses. · subgraph.com, 7 Oct 2026
- Authenticated proxy scanning
- The proxy scanner can use client cookies to preserve authenticated sessions while scanning target paths. · subgraph.com, 7 Oct 2026
- Authentication
- Automated scans support HTTP Basic, HTTP Digest, NTLM, and macro based form authentication; scanner requests can also include configured cookies. · subgraph.com, 7 Oct 2026
- Automated scanning
- Its scanner crawls websites, processes forms, finds possible injection points, and runs modules that can test for issues such as cross-site scripting and SQL injection. · subgraph.com, 7 Oct 2026
- Discontinued
- Subgraph says Vega is discontinued. · subgraph.com, 7 Oct 2026
- Extensibility
- Vega supports JavaScript modules for active fuzzing and response processing, and modules can generate XML based alerts. · subgraph.com, 7 Oct 2026
- Headquarters
- Montreal, Canada · subgraph.com, 28 Sept 2026
- HTTPS interception
- For HTTPS inspection, Vega generates replacement certificates signed by its own certificate, which can be imported into the browser. · subgraph.com, 7 Oct 2026
- Intercepting proxy
- The proxy lets users inspect browser requests and server responses, set breakpoints, and edit intercepted traffic before releasing it. · subgraph.com, 7 Oct 2026
- Maker
- Vega is developed by Subgraph, described in its documentation as an open source security startup based in Montreal, Canada. · subgraph.com, 7 Oct 2026
- Product
- Vega is a GUI based platform for testing web application security, written in Java. · subgraph.com, 7 Oct 2026
- Proxy
- Its intercepting proxy lets users inspect, hold and edit browser requests and server responses. · subgraph.com, 7 Oct 2026
- Proxy editing
- The proxy message viewer supports HTML syntax highlighting, and binary data can be viewed and edited with a built-in hex editor. · subgraph.com, 7 Oct 2026
- Proxy scanning
- Vega can fuzz parameters and actively test pages in scope as users visit them through the proxy. · subgraph.com, 7 Oct 2026
- Purpose
- Vega is a GUI-based platform for testing the security of web applications. · subgraph.com, 7 Oct 2026
- Scan controls
- Scanner preferences can limit path descendants, child paths, path depth, duplicate path elements, alert text length, and requests per second. · subgraph.com, 7 Oct 2026
- Scanner
- Its automated scanner crawls websites, extracts links and processes forms to find possible injection points. · subgraph.com, 7 Oct 2026
- Scanning through proxy
- Vega can fuzz parameters and actively test pages in the target scope as users visit them through the proxy. · subgraph.com, 7 Oct 2026
- Scope behavior
- The scanner supports target scopes with multiple base URIs and exclusions, and the documentation says it will not crawl links on other websites. · subgraph.com, 7 Oct 2026
- Security caution
- The scanner guide advises experimenting with Vega on servers that belong to the user and are not in production use. · subgraph.com, 7 Oct 2026
- Status
- The download page states that Vega is discontinued. · subgraph.com, 7 Oct 2026
- Support
- Subgraph points users to online documentation, the #subgraph OFTC IRC channel, the Vega-Users Google Group, and GitHub issues for bug reports and feature requests. · subgraph.com, 7 Oct 2026
- Use limitation
- The scanner documentation advises experimenting on servers owned by the user and not in production use. · subgraph.com, 7 Oct 2026