Can anyone recommend any good security testing resources? Although I have a basic security skillset, I'd like to improve this. Some of the training I've seen online however seems kind of sketchy. Resources would have to be a reasonable price.

I know that there's no one answer for this, but still, hoping for some recommendations.

  • 1
    Not really an answer, but one big thing to keep in mind about security is that a lot of it isn't necessarily related to your app, but rather the environment your app runs in. One of the best things you can do to test security is to set up the app in a fresh environment. If the security measures aren't part of the scripted install/setup process, it's just begging to get breached when someone forgets a step like... locking down iptables or forgetting a database or file permission or something. – corsiKa May 8 '11 at 6:52

For web application security you might find it useful - https://www.owasp.org/index.php/Main_Page

  • Although the other answers were very good, and I already have some experience with OWASP, I have to say that OWASP is still the best resource out of what was presented. – Lyndon Vrooman Jun 9 '11 at 23:24

How to Break Software Security

This book has a lot of good ideas you can try.

  • Very good book to pick up & have on your shelf. – CKlein May 9 '11 at 12:55

Also consider doing threat models - IME, when testers are part of the threat model process, they generally find security issues nobody else does.

  • Hadn't come across threat models before - thanks, sounds useful! – testerab May 8 '11 at 22:14

If security is important to the success of your application, I would suggest hiring professionals from firms such as HP, Cigital, SecurityCompass, etc and observing how they approach it. Books and websites are one thing, but you really need mentorship too...



Googles site for security testing: http://google-gruyere.appspot.com/ - really useful.

Try going through both sites with a copy of the book suggested by Alan - they really complement each other.


For web application security you could try with some tools like

  • 1
    Is Grendel Scan still maintained? I see the last blog post for it was in 2008. – Lyndon Vrooman May 11 '11 at 19:43

Saw this site recommended recently as a good resource for those wanting to practice security testing:


  • Interesting. Starting to check it out. – Lyndon Vrooman May 8 '11 at 20:59

This may help - http://www.guru99.com/ethical-hacking-tutorials.html

You can also learn about Penetration Testing here

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

protected by Community Sep 19 at 7:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.