Research has shown that a vast number of Web sites are vulnerable to Web application attacks and that a great percentage of these attacks occur over the HTTP/S protocols, ports that are often exposed to the entire online community. With these facts in mind, it's essential for organizations to take serious measures to help secure their Web applications. As Web applications become increasingly complex, tremendous amounts of sensitive data--including personal, medical and financial information--are exchanged and stored. Consumers expect and even demand that this information be kept secure. This paper explains the two primary methods for discovering Web application vulnerabilities: using manual penetration testing and code review or using automated scanning tools and static analysis.