Google - Ready, aim, fire: an open-source tool to test web security scanners

googleonlinesecurity.blogspot.com