How do you test a web site for security, performance and etc...

Page 1 of 1

3 Replies - 771 Views - Last Post: 17 March 2013 - 07:04 AM

#1 noorahmad  Icon User is offline

  • Untitled
  • member icon

Reputation: 209
  • View blog
  • Posts: 2,290
  • Joined: 12-March 09

How do you test a web site for security, performance and etc...

Posted 14 February 2013 - 08:59 AM

Hello all,

I am assigned to test a social network website developed in PHP, MySQL and MooTools.

Usually, how do you check your web apps for security, performance and all other major parts need to be tested.


Thanks
Is This A Good Question/Topic? 0
  • +

Replies To: How do you test a web site for security, performance and etc...

#2 TheKirk  Icon User is offline

  • D.I.C Head

Reputation: 7
  • View blog
  • Posts: 58
  • Joined: 10-February 13

Re: How do you test a web site for security, performance and etc...

Posted 14 February 2013 - 09:13 AM

I would start with some automated tests using tools such as Acunetix Vulnerability Scanner and Nikto:



Then you can go bug-hunting by hand!
Was This Post Helpful? 1
  • +
  • -

#3 Lemur  Icon User is offline

  • Vim good, Emacs bad
  • member icon


Reputation: 1250
  • View blog
  • Posts: 3,247
  • Joined: 28-November 09

Re: How do you test a web site for security, performance and etc...

Posted 15 February 2013 - 08:38 PM

Buy a copy of Hacking Exposed - Web Applications. It more than covers most vectors of attack, but the big ones you want to find are:

XSS
SQL Injection
Page Inclusion
Directory Traversal
Poison Null
Session Hijacking
Was This Post Helpful? 0
  • +
  • -

#4 CynicalSolution  Icon User is offline

  • New D.I.C Head

Reputation: -3
  • View blog
  • Posts: 15
  • Joined: 17-March 13

Re: How do you test a web site for security, performance and etc...

Posted 17 March 2013 - 07:04 AM

As far as tools

Havij Pro - SQL Injection
XSSsEk3r - I wrote this myself (I might release), runs through every known xss attack and try's it
MetaSpl0it Framework (Armitage GUI) - Pentesting server itself
zenmap - checking open ports
Will post more tomorrow but start there
Was This Post Helpful? 0
  • +
  • -
Page 1 of 1