Pixy is an open source vulnerability scanner that audits PHP applications for SQL injection and cross site scripting vulnerabilities. It is written in Java and also performs automatic resolution of file inclusions.
You can download it from the following link: https://packetstormsecurity.com/files/download/57255/pixy_3_01.zip
Source: https://packetstormsecurity.com/files/57255/pixy_3_01.zip.html