Web Security

Achilles is a tool designed for testing the security of web applications
WebInspect -- runs on Windows 98/NT/2000/XP, can audit Apache, IIS, etc., audits web applications running on web servers and tying into backend services and servers: http://www.spidynamics.com
whisker -- test your server for CGI vulnerabilities: http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2

Web Based Session Management Best Practices in Managing HTTP Based Client Sessions by Gunter Ollmann
HTML Code Injection and Cross-site scripting Understanding the cause and effect of CSS (XSS) Vulnerabilities by Gunter Ollmann
Custom HTML Authentication Best Practices on Securing Custom HTML Authentication Procedures By Gunter Ollmann
URL Encoded Attacks Attacks using the common web browser by Gunter Ollmann
Second-order Code Injection Advanced Code Injection Techniques and Testing Procedures by Gunter Ollmann
Security Best Practice - Host Naming and URL Conventions Security Considerations for Web-based Applications by Gunter Ollmann
Anti Brute Force Resource Metering Helping to Restrict Web-based Application Brute Force Guessing Attacks through Resource Metering by Gunter Ollmann
Stopping Automated Attack Tools An analysis of web-based application techniques capable of defending against current and future automated attack tools by Gunter Ollmann
WWW Security FAQ: http://www.w3.org/Security/faq/
WWW Security Resources: http://www.w3.org/Security/
Index of WWW security links: http://www.alw.nih.gov/Security/security-www.html
NCSA CGI Programming Guide: http://hoohoo.ncsa.uiuc.edu/cgi/security.html
Perl Security http://reference.perl.com/query.sgi?security/