Ask HN: How do you perform penetration testing on your webapp?

Is there a browser plugin or app that can help me reveal security holes in my web app? Something like a Metasploit for the web.

So far I've been writing my own tests, but there is no question someone smarter than me will find a vulnerability. There are a number of great resources on the different types of exploits and how to fix them, but I havent found anything to tell me if I've implemented the solution correctly.