We'd like to perform some automated penetration testing on our mojoPortal-based application (to test for some common vulnerabilities like SQL injection, cross site scripting, etc.).  I've come across skipfish (http://code.google.com/p/skipfish/) as a potential solution to this problem, but I was wondering what other tools people have found helpful. Free and low-cost solutions are preferred. Thanks!