Plus, I'd be very interested to know if any of those are useful. We've just been asked to look into Security Testing, and as functional testers we're a little bit lost at sea ;-)
Those ones seem to be recommended on the testing forums I've looked at, but god knows what it is you actually do with them (as in, Webscarab can be used to intercept and modify requests between client and server, but how you use that functionality to comprehensively test the security is beyond me...)