Tag Info

Hot answers tagged

11

Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project And generally I would advise browsing the site to learn more about security Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/


10

This book has a lot of good ideas you can try.


8

For web application security you might find it useful - https://www.owasp.org/index.php/Main_Page


8

Burp Suite would be worth checking out if you're fuzz testing web applications. As the name implies, it's actually a suite of different web security testing tools - I used it for the first time on Monday in a pen testing workshop and it seems like a tremendously useful tool. Burp Intruder is the tool used for fuzzing attacks - and here's a video tutorial ...


8

Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not? Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow? Your BA approved this. Did she say why it should be permitted? What happens in your portal when an ...


7

First, your product probably has some kind of security-related provisions: e.g. authentication, authorization, password recovery, prevent one user from seeing another user's data, and so on. There will be positive and negative test cases for those. Beyond that is the more complicated stuff. There are tools available for scanning websites for security ...


7

If you're willing to spend a little bit of cash, I'd recommend both How to Break Web Software and the Web Security Testing Cookbook. I also recommend playing around with things like Damn Vulnerable Web Application and WebGoat. Should give you a decent start.


6

This kind of testing can be incredibly fun and can expose a wide variety of defects outside of its core focus; making sure you can't destroy data. I'm no expert but I do have a few tips I hope you'll find helpful. There are a variety of ways to try and inject SQL queries and commands into the web application; text input fields are the most obvious but ...


6

Also consider doing threat models - IME, when testers are part of the threat model process, they generally find security issues nobody else does.


6

Even though we've never tried doing so, I can almost certainly answer your question: No Because finding a security flaw is not a procedure - it requires a skill-set. Not everyone can do it - and bot would be the last thing I would expect me to report a real security issue. They're sometimes good to find basic flaws like SQL Injections etc. but integrating ...


6

Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns. You can look at those examples then try to relate them to where they would apply to your application.


5

I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing. Network security testing is typically related to network ...


5

Welkome Ashok. I think that you need to be very careful with this. Security testing is a field that you REALLY, REALLY need to know what you are testing for. Security testing does not simply mean "point a tool at a site and get the results" If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking ...


5

There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website". Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...


4

The above answers are correct, and depending on the importance of the security, you are probably best advised to get some security experts in. Other than that, in order for you to have a go yourself, some useful resources I use to dabble in security testing / ethical hacking are : https://www.owasp.org/index.php/Main_Page http://google-gruyere.appspot.com/ ...


4

Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS. Prevention is the best defense. The best first line of defense is to integrate security into your software ...


4

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks. Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack. Consider what kinds of escape characters, improper type handling, etc could make their ...


3

From Application level you need to check how does the code handle parameters. Are there any validations done on this parameters (Length, Datatype checks) Best Practices Use of parameterized queries Use Procedures Grant only execute permission for SP. No DDL operations for users Alternative I would suggest you look at how code is written You can check ...


3

I think this question is more suited at http://security.stackexchange.com . The following questions has been answered over there which are similar to your question: what-are-some-good-website-security-scanning-solutions testing-sql-injection-using-sqlmap im-trying-to-find-how-to-exploit-my-sql-code testing-php-form-injection testing-for-dangling-cursor


3

I haven't used it myself (although I plan to on my side-project when I get it to private alpha stage) but I think Hexawise would be able to do some of this. You can tweak the phasing parameters (2 pairwise, 3 pairwise, I think it goes up to 6) and it will generate values in certain ranges. This should be pretty close to what you're looking to do. You can ...


3

While I agree in the main with Tom77's answer. From a security perspective abuse/misuse lead to the same consequences. However I would also suggest that misuse cases should be used as inputs to ongoing design and implementation reviews. Try to reduce the possibility of misuse. If the user can accidentally misuse the system then they will also have a ...


3

If you are hoping to find the vulnerabilities through an automate scan Open the application, click "Start New Scan", enter the address, and then start scan. Please note, the community edition will really only find low hanging fruit. Anything more difficult requires a subscription. If you're hoping to do some manual testing for injection vulnerabilities, ...


3

I think much like any new application, once you get it up and running walk through any demos that may be provided. If there are forums you might want to look at those as well. Clearly as their site indicates as you are working with it be sure you are only doing it against a site that you are authorized to perform that sort of penetration testing on.


3

I've used a couple of solutions for this in the past. Both Acunetix and IBM Rational AppScan will test for Reflected, Stored, and DOM based Cross Site Scripting. Both applications will provide you all relevant information including request, response, potential impact, etc. AppScan will actually provide a screen shot from what I can remember. Both will ...


3

Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com. For example, most vulnerabilities in many common web-applications (e.g. WordPress, osCommerce, Joomla) are/were because folders were left write-enabled and/or ...


3

Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;). However there are still various options available to you. One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the ...


3

I would start here: https://www.owasp.org/index.php/Main_Page Lots of good reading, tools, videos, etc.


3

In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.


3

I tested credit provider gateways and implementations for years, so I can give a few suggestions: Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway: Data transmitted to the gateway is sent over a secured channel (https or some other secure means) Data logged does not include ...


2

http://www.hackthissite.org/pages/index/index.php Googles site for security testing: http://google-gruyere.appspot.com/ - really useful. Try going through both sites with a copy of the book suggested by Alan - they really complement each other.



Only top voted, non community-wiki answers of a minimum length are eligible