W3af (Web Application Attack and Audit Framework) is an open-source framework for finding and exploiting web application vulnerabilities. It provides over 130 plugins covering discovery, audit, grep, brute force, attack, evasion, and output, offering both a console and GUI interface.