Zero-configuration, automated, random testing tools for web-apps?

Question

In short, I'm looking for a tool to perform an automated, zero-configuration, full-frontal assault on a web application.

I'm thinking this would logically be a browser-extension that both crawls links on a given domain/path, AND randomly inputs data into forms and submits them. Specifically, form input would randomly include various data types, special characters, excessive data, various character encodings, and null values. Multithreading is a necessity (perhaps one plugin simply utilizing multiple Firefox tabs).

The tool does NOT (and should not) need to make any assertions about the results, or verify any application behavior. Instead, the persistence layer (DB records, etc) and applications logs would be used to evaluate the results of this "testing effort."

This would be a tool to complement existing testing tools (Selenium, QuickTestPro) and methodologies that may not have 100% coverage.

Any suggestions for existing or in-development tools? If not, I am eager to start an open-source project.

CLARIFICATION: I am specifically not looking for a penetration testing tool.

UPDATE: I have founded an open source project to satisfy this question. See comments below.

Answer 1

What about paros? http://www.parosproxy.org/functions.shtml

Answer 2

I used the trial of Acunetix for a while. It seemed reasonably effective, although it took longer than I thought it ought to and it's certainly not open source.

I forgot what the thing was called, and this list at SoftwareQATest is where I found it again. That list may be useful to you. The list of testing tools at OWASP looks similarly handy.

Answer 3

It sounds like a fuzz testing tool may be what you need; tools like Wapiti will scan your app looking for parameterized URLs and forms to fill out, and use randomly generated data to exercise them.

Here is a good list of web app fuzzing tools.

Answer 4

I'm not sure I've came across anyting that fits the bill exactly, but Sulley is fairly close...

http://code.google.com/p/sulley/

I've never used it first hand, but I've heard it mentioned. Additionally, perhaps check this out:

http://www.owasp.org/index.php/Category:OWASP_JBroFuzz