Skipfish is a fully automated, active web application security reconnaissance tool. http://code.google.com/p/skipfish/