Hot answers tagged

11

Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project And generally I would advise browsing the site to learn more about security Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/


10

This book has a lot of good ideas you can try.


10

For web application security you might find it useful - https://www.owasp.org/index.php/Main_Page


9

If you're willing to spend a little bit of cash, I'd recommend both How to Break Web Software and the Web Security Testing Cookbook. I also recommend playing around with things like Damn Vulnerable Web Application and WebGoat. Should give you a decent start.


8

Even though we've never tried doing so, I can almost certainly answer your question: No Because finding a security flaw is not a procedure - it requires a skill-set. Not everyone can do it - and bot would be the last thing I would expect me to report a real security issue. They're sometimes good to find basic flaws like SQL Injections etc. but integrating ...


8

First, your product probably has some kind of security-related provisions: e.g. authentication, authorization, password recovery, prevent one user from seeing another user's data, and so on. There will be positive and negative test cases for those. Beyond that is the more complicated stuff. There are tools available for scanning websites for security ...


8

Burp Suite would be worth checking out if you're fuzz testing web applications. As the name implies, it's actually a suite of different web security testing tools - I used it for the first time on Monday in a pen testing workshop and it seems like a tremendously useful tool. Burp Intruder is the tool used for fuzzing attacks - and here's a video tutorial ...


8

Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not? Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow? Your BA approved this. Did she say why it should be permitted? What happens in your portal when an ...


6

Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns. You can look at those examples then try to relate them to where they would apply to your application.


6

This kind of testing can be incredibly fun and can expose a wide variety of defects outside of its core focus; making sure you can't destroy data. I'm no expert but I do have a few tips I hope you'll find helpful. There are a variety of ways to try and inject SQL queries and commands into the web application; text input fields are the most obvious but ...


6

Also consider doing threat models - IME, when testers are part of the threat model process, they generally find security issues nobody else does.


6

Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS. Prevention is the best defense. The best first line of defense is to integrate security into your software ...


6

I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing. Network security testing is typically related to network ...


6

Welkome Ashok. I think that you need to be very careful with this. Security testing is a field that you REALLY, REALLY need to know what you are testing for. Security testing does not simply mean "point a tool at a site and get the results" If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking ...


5

I've used a couple of solutions for this in the past. Both Acunetix and IBM Rational AppScan will test for Reflected, Stored, and DOM based Cross Site Scripting. Both applications will provide you all relevant information including request, response, potential impact, etc. AppScan will actually provide a screen shot from what I can remember. Both will ...


5

The above answers are correct, and depending on the importance of the security, you are probably best advised to get some security experts in. Other than that, in order for you to have a go yourself, some useful resources I use to dabble in security testing / ethical hacking are : https://www.owasp.org/index.php/Main_Page http://google-gruyere.appspot.com/ ...


5

There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website". Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, ...


5

Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests. If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent ...


4

From Application level you need to check how does the code handle parameters. Are there any validations done on this parameters (Length, Datatype checks) Best Practices Use of parameterized queries Use Procedures Grant only execute permission for SP. No DDL operations for users Alternative I would suggest you look at how code is written You can check ...


4

If you are hoping to find the vulnerabilities through an automate scan Open the application, click "Start New Scan", enter the address, and then start scan. Please note, the community edition will really only find low hanging fruit. Anything more difficult requires a subscription. If you're hoping to do some manual testing for injection vulnerabilities, ...


4

I think much like any new application, once you get it up and running walk through any demos that may be provided. If there are forums you might want to look at those as well. Clearly as their site indicates as you are working with it be sure you are only doing it against a site that you are authorized to perform that sort of penetration testing on.


4

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks. Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack. Consider what kinds of escape characters, improper type handling, etc could make their ...


4

Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;). However there are still various options available to you. One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the '...


3

There is Microsoft's own Attack Surface Analyzer Tool which was first released in 2011, runs on Vista/Win7/Win Server 2008 and generates reports in HTML format. Attack Surface Analyzer is all in one tool for analysis of changes made to the various parts of the attack surface of Windows 6 series Operating System (includes Windows Vista and Windows 7). ...


3

While I agree in the main with Tom77's answer. From a security perspective abuse/misuse lead to the same consequences. However I would also suggest that misuse cases should be used as inputs to ongoing design and implementation reviews. Try to reduce the possibility of misuse. If the user can accidentally misuse the system then they will also have a ...


3

I think this question is more suited at http://security.stackexchange.com . The following questions has been answered over there which are similar to your question: what-are-some-good-website-security-scanning-solutions testing-sql-injection-using-sqlmap im-trying-to-find-how-to-exploit-my-sql-code testing-php-form-injection testing-for-dangling-cursor


3

I haven't used it myself (although I plan to on my side-project when I get it to private alpha stage) but I think Hexawise would be able to do some of this. You can tweak the phasing parameters (2 pairwise, 3 pairwise, I think it goes up to 6) and it will generate values in certain ranges. This should be pretty close to what you're looking to do. You can ...


3

For the most part mobile web applications behave exactly the same as their counterparts on a desktop. Even if the user input is slightly different, the mobile application is still interfacing with the device running it in a similar fashion, sending along similar protocols and being interpreted on the back end is as well (likely). If information is being ...


3

Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com. For example, most vulnerabilities in many common web-applications (e.g. WordPress, osCommerce, Joomla) are/were because folders were left write-enabled and/or file-...


3

I would start here: https://www.owasp.org/index.php/Main_Page Lots of good reading, tools, videos, etc.



Only top voted, non community-wiki answers of a minimum length are eligible