Tag Info

Hot answers tagged

10

This book has a lot of good ideas you can try.


9

Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project And generally I would advise browsing the site to learn more about security Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/


8

For web application security you might find it useful - https://www.owasp.org/index.php/Main_Page


8

Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not? Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow? Your BA approved this. Did she say why it should be permitted? What happens in your portal when an ...


7

Burp Suite would be worth checking out if you're fuzz testing web applications. As the name implies, it's actually a suite of different web security testing tools - I used it for the first time on Monday in a pen testing workshop and it seems like a tremendously useful tool. Burp Intruder is the tool used for fuzzing attacks - and here's a video tutorial ...


7

If you're willing to spend a little bit of cash, I'd recommend both How to Break Web Software and the Web Security Testing Cookbook. I also recommend playing around with things like Damn Vulnerable Web Application and WebGoat. Should give you a decent start.


6

Also consider doing threat models - IME, when testers are part of the threat model process, they generally find security issues nobody else does.


6

Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns. You can look at those examples then try to relate them to where they would apply to your application.


6

This kind of testing can be incredibly fun and can expose a wide variety of defects outside of its core focus; making sure you can't destroy data. I'm no expert but I do have a few tips I hope you'll find helpful. There are a variety of ways to try and inject SQL queries and commands into the web application; text input fields are the most obvious but ...


5

First, your product probably has some kind of security-related provisions: e.g. authentication, authorization, password recovery, prevent one user from seeing another user's data, and so on. There will be positive and negative test cases for those. Beyond that is the more complicated stuff. There are tools available for scanning websites for security ...


5

Even though we've never tried doing so, I can almost certainly answer your question: No Because finding a security flaw is not a procedure - it requires a skill-set. Not everyone can do it - and bot would be the last thing I would expect me to report a real security issue. They're sometimes good to find basic flaws like SQL Injections etc. but integrating ...


5

I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing. Network security testing is typically related to network ...


4

Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS. Prevention is the best defense. The best first line of defense is to integrate security into your software ...


4

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks. Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack. Consider what kinds of escape characters, improper type handling, etc could make their ...


4

Welkome Ashok. I think that you need to be very careful with this. Security testing is a field that you REALLY, REALLY need to know what you are testing for. Security testing does not simply mean "point a tool at a site and get the results" If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking ...


3

I've used a couple of solutions for this in the past. Both Acunetix and IBM Rational AppScan will test for Reflected, Stored, and DOM based Cross Site Scripting. Both applications will provide you all relevant information including request, response, potential impact, etc. AppScan will actually provide a screen shot from what I can remember. Both will ...


3

If you are hoping to find the vulnerabilities through an automate scan Open the application, click "Start New Scan", enter the address, and then start scan. Please note, the community edition will really only find low hanging fruit. Anything more difficult requires a subscription. If you're hoping to do some manual testing for injection vulnerabilities, ...


3

I think much like any new application, once you get it up and running walk through any demos that may be provided. If there are forums you might want to look at those as well. Clearly as their site indicates as you are working with it be sure you are only doing it against a site that you are authorized to perform that sort of penetration testing on.


3

While I agree in the main with Tom77's answer. From a security perspective abuse/misuse lead to the same consequences. However I would also suggest that misuse cases should be used as inputs to ongoing design and implementation reviews. Try to reduce the possibility of misuse. If the user can accidentally misuse the system then they will also have a ...


3

I think this question is more suited at http://security.stackexchange.com . The following questions has been answered over there which are similar to your question: what-are-some-good-website-security-scanning-solutions testing-sql-injection-using-sqlmap im-trying-to-find-how-to-exploit-my-sql-code testing-php-form-injection testing-for-dangling-cursor


3

From Application level you need to check how does the code handle parameters. Are there any validations done on this parameters (Length, Datatype checks) Best Practices Use of parameterized queries Use Procedures Grant only execute permission for SP. No DDL operations for users Alternative I would suggest you look at how code is written You can check ...


3

Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com. For example, most vulnerabilities in many common web-applications (e.g. WordPress, osCommerce, Joomla) are/were because folders were left write-enabled and/or ...


3

In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.


2

I haven't used it myself (although I plan to on my side-project when I get it to private alpha stage) but I think Hexawise would be able to do some of this. You can tweak the phasing parameters (2 pairwise, 3 pairwise, I think it goes up to 6) and it will generate values in certain ranges. This should be pretty close to what you're looking to do. You can ...


2

I would probably look at STRIDE and allocate a given time to each of the threat areas, the duration that is allocated however, will be determined by the skill and experience of the tester. If there aren't any experienced security testers in the team then you probably wont get any really value from doing this in house, it really is a specialist area. You can ...


2

The above answers are correct, and depending on the importance of the security, you are probably best advised to get some security experts in. Other than that, in order for you to have a go yourself, some useful resources I use to dabble in security testing / ethical hacking are : https://www.owasp.org/index.php/Main_Page http://google-gruyere.appspot.com/ ...


2

I am not a security tester, however, your test planning will vary depending on whether you need to maintain the secure status of the web application, or whether you are doing a one-off "this application is secure" set of tests. In both cases, I do think you need to plan - but for one-off test sets you don't need to plan for repeatability. I'd look at ...


2

http://www.hackthissite.org/pages/index/index.php Googles site for security testing: http://google-gruyere.appspot.com/ - really useful. Try going through both sites with a copy of the book suggested by Alan - they really complement each other.


2

If security is important to the success of your application, I would suggest hiring professionals from firms such as HP, Cigital, SecurityCompass, etc and observing how they approach it. Books and websites are one thing, but you really need mentorship too...


2

There is still ambiguity between the words. A quick Google search for "abuse case testing" brings up this which states: An Abuse cases can describe the possible misuse of an application I agree that abuse cases are a subset of misuse cases. I also agree that abuse cases contain more malice as Tom77 suggested. But if a line has to be drawn and a ...



Only top voted, non community-wiki answers of a minimum length are eligible