Printable View
I am a looking for tools to help test website security. I am starting a new QA/QC department for the company where I work, I haven't tested web security before and I need to have a test suite that will perform some hacking, security, load performance and functionality if possible. Please HELP!!!
You could have found this if you had searched the forums here but it is your first post so just start searching before posting.
Nessus works wonders........
www.nessus.org
I am not just using Unix or Linux. I need tools that work for all OS's
I am also looking for web page/site testing tools.
so your saying you want us to provide you with every hacking tool known to man.....i dont think so
I'm pretty sure that we don't need... our good friend www.google.com has already done that. ;)Quote:
Originally posted here by Tedob1
so your saying you want us to provide you with every hacking tool known to man.....i dont think so
Not every tool just one really good one.
Do you guys actually build internet sites and work with secuirty or do you just surf.
Maybe the knowledge level I'm looking for is beyond what a bunch of google searchers can handle.
well if its tool your after have a look a thread I posted a while a go.
http://www.antionline.com/showthread...829#post615829
However you need more than tools to test the security of web application, most vulnerability are found by the skill of the tester. I would suggest you have a very good read of www.owasp.org there is alot of very good info on that site.
The best book I know for this topic has to be hacking exposed "web application" well worth the money
All I can say the use of tool is not the best way forward for the testing of web application. Hope this helps
SittingDuck
Quote:
Originally posted here by DocP
Not every tool just one really good one.
Do you guys actually build internet sites and work with secuirty or do you just surf.
Maybe the knowledge level I'm looking for is beyond what a bunch of google searchers can handle.
Is that an insult? Pretty funny coming from someone asking us to do his homework for him. :thumbsup:
>>Do you guys actually build internet sites and work with secuirty or do you just surf.
Well I don't see any reason to answer that rediculious question, anywho.
I did a google search for "Testing Website Security" and the first result lead me to this article:
http://www.linuxworld.com/go.cgi?id=742217
At the end of the article is a bunch of links to such tools for testing web site security. Which begs the question, did you search.
Back to the origional google search, along the right side, is an advertisement for "Security Analysis Scan" I clicked on it and it, very fascinateing. I also did a search for "security tools" and got some usefull results.
HTH
There are some basic tools for checking things out such as:
Coast web master - link checker and slaps the server with load
Black widow - indexes a site for offline viewing and can be helpful for looking for sensitive information on a website.
There aren't many (if any) comprehensive pre-built tools for doing all of that testing on web applications. Your best bet will most likely be grabbing a test automation tool such as silk by segue, rsw e-test suite, rational visual test, etc...or using your favorite programming language and writing your own test automation libraries.
You will also probably want to grab a copy of silk performer/winrunner/etc to do some nice load testing of your web apps.
I tested e-commerce web apps for a few years so if you have any questions or need any suggestions give me a shout.
For suggestions on methodology I highly reccomend checking out the sec focus website since they have some great articles on auditing web application authentication and so on. www.sans.org has quite a few papers on web application security, auditing, and standards in their reading room and in the papers done by people seeking their certifications (many of these can be found in the cert specific area on www.giac.org). Finally the owasp project is working on standards and tools for web app security.
D'oh...almost forgot. Security Focus also has a web app sec mailing list that you would probably find helpful.
Hey Hey,
Well I think your a jackass for starters and the odds are you are nothing more than a script kiddie based on your pathetic attempt at insulting us. I'll still offer ya some assistance though because I'm such a sweetheart :). I tend to scan my webserver with N Stealth after I set-up a website. It is available from http://www.nstalker.com.
Good luck and if you are a script kiddie I hope this helps you find your way to a roommate named Bubba.
That would be Doctor Jackass to you, thanks for the information all the same. I'm not a script kiddie, just a quality junkie.Quote:
Well I think your a jackass for starters and the odds are you are nothing more than a script kiddie based on your pathetic attempt at insulting us.
Additionally, I would like to especially thank SittingDuck for the information and link to the past thread. I When working at breakneck speed you don't always have time to research everything , so its especially helpful to have someone who is willing to provide the information (without the attitude). I guess there are a few here who know what they are talking about.
I'd also like to thank whoever it was that sent me the negative anti-points, always nice to know that there are still shallow light minded backstabbers in the crowd.
Doc P.
",We are what we repeatedly do. Excellence, then is not an act, but a habit."
if you want to do vulnerability checking, try out Nikto and Whisker. They will crawl your site for some nasty scripts. You can also do parameter fuzzing with SPIKE proxy. If you don't know what that is, you shouldn't be using it before you read some tuts.
Soooo the doc has a problem with me because i worked in fast food? should i feel bad because you think i work at Mcdonalds? your asking people to do your ****ing homework. Youll learn soon enough that your little "im a **** and i dont care" attitude, Not ONE ****ing hacker here is going to do **** for you, we all learned ourselves and thats how it is, if you dont like it dont ****ing get into it.
Oh and the drug thing. I dont abuse drugs you ****ing ****. And id love to see you getting carved up, as soon as you were hurting enough youd beg for drugs like anyone else. ****ing hypocrits "Drugs are bad, oh wait im sore drug me"
Cmon doc lets argue im in the mood for it and iv never lost an arguement about drugs yet. I didnt even ****ing say anything and you attack me? tell ya what, your the big all mighty good guy, post your IP we can play a game.
Maybe you should go work for SCO, i rather WOULD work in fast food than there. Oh and in case you wondered, the post i said i worked in fast food was how long ago? A local company here is thinking of hiring me as a sys admin for AS/400. So eat a ****ing **** and choke on my name.
Maybe Tedob1 kinda jumped to soon with the accusations... but lets face it... your not only a ******* but your also stupid as hell. For one thing when you attempted to insult a entire e-community for almost no reason at all then its only natural to be flamed & neged to death so you should have already expected this as soon as you posted here ya idiot. http://www.freewebs.com/tomchop/tools.htmlQuote:
Originally posted here by DocP
so its especially helpful to have someone who is willing to provide the information (without the attitude). I guess there are a few here who know what they are talking about.
I'd also like to thank whoever it was that sent me the negative anti-points, always nice to know that there are still shallow light minded backstabbers in the crowd.
Doc P,We are what we repeatedly do. Excellence, then is not an act, but a habit."
Quote:
Originally posted here by DocP
Not every tool just one really good one.
Do you guys actually build internet sites and work with secuirty or do you just surf.
Maybe the knowledge level I'm looking for is beyond what a bunch of google searchers can handle.
its funny because its true
The really humorous part of this thread is:
1. I got what I wanted (you have such high esteem of yourselves)
2. Your panties are in a twist (mostly due to lack of real education) (gore)
3. You really are script kiddies and google searchers
4. That's Enough - and your right some one with my experience (20+ years in IT (that would mean yes I was hacking and coding when... you were all... well you know doing what your doing now... ...shitting yourselves) shouldn't play in the shallow end of the gene pool. cancel me because I won't be back.
Please please you'll help the world if you all continue to stand around and pat yourselves on the back about how great you are. Because, no one else is going to do it (are there three of you in this mutual admiration society?). The truly sad thing is you can't have the last word because I won't be back to read the response.
Oh and one more thing at least I can spell.
:D :o
Don't go away mad, just go away!
Oh good your leaving. ****ing ****. "OoooOoOo gore would own my ass and my Mom if I actually wanted to argue with him, I'll just assume hes NOT in college getting good grades without even opening the books'Quote:
Originally posted here by DocP
The really humorous part of this thread is:
1. I got what I wanted (you have such high esteem of yourselves)
2. Your panties are in a twist (mostly due to lack of real education) (gore)
3. You really are script kiddies and google searchers
4. That's Enough - and your right some one with my experience (20+ years in IT (that would mean yes I was hacking and coding when... you were all... well you know doing what your doing now... ...shitting yourselves) shouldn't play in the shallow end of the gene pool. cancel me because I won't be back.
Please please you'll help the world if you all continue to stand around and pat yourselves on the back about how great you are. Because, no one else is going to do it (are there three of you in this mutual admiration society?). The truly sad thing is you can't have the last word because I won't be back to read the response.
Oh and one more thing at least I can spell.
:D :o
Don't go away mad, just go away!
pff dude, 2o years in IT and you came here to ask us anything? your pathetic.
mv /home/docp /home/shitHeadLand
rm -rf /home/docp
See ya later *******. Don't let the browser hit you in the ass on the way out....heh oh yea im the Bastard its already set up too.
I don't mean to get involved , but google is what makes the world go round at AO. And second that's all script kiddies care about is getting what they want and not care what it's doing or how it works. ( Kinda like Yourself ) LOL , and you insult gore that he abuses drugs , wtf you judge someone's personal life that you don't even know ? Well now that you got what you want , i'll leave you alone so you can go infect your neighbor with sub seven.
Toodles.
Quote:
Originally posted here by gore
Soooo the doc has a problem with me because i worked in fast food? should i feel bad because you think i work at Mcdonalds? your asking people to do your ****ing homework. Youll learn soon enough that your little "im a **** and i dont care" attitude, Not ONE ****ing hacker here is going to do **** for you, we all learned ourselves and thats how it is, if you dont like it dont ****ing get into it.
Oh and the drug thing. I dont abuse drugs you ****ing ****. And id love to see you getting carved up, as soon as you were hurting enough youd beg for drugs like anyone else. ****ing hypocrits "Drugs are bad, oh wait im sore drug me"
Cmon doc lets argue im in the mood for it and iv never lost an arguement about drugs yet. I didnt even ****ing say anything and you attack me? tell ya what, your the big all mighty good guy, post your IP we can play a game.
Maybe you should go work for SCO, i rather WOULD work in fast food than there. Oh and in case you wondered, the post i said i worked in fast food was how long ago? A local company here is thinking of hiring me as a sys admin for AS/400. So eat a ****ing **** and choke on my name.
This post reminds me of a fortune cookie I once received. "Strong words indicate a weak cause"
You know I was having a shitty day and wasn't going to really post anything because of my mood, but I think I will now. The real funny thing is I don't even need to say anything, because everyone here has beaten me to it. But the fact still stands, you come here to us and ask for help. IF you would have read the FQA's, you would understand we do not like script babies and wonder when people ask questions like yours. Plus even in the fact of picking on you, most of the people that posted still helped you out.
--> If that is true, then why do you need our help? You would have to be around 45 if you went to college and have been in the IT business itself for 20+ yearsQuote:
4. That's Enough - and your right some one with my experience (20+ years in IT (that would mean yes I was hacking and coding when... you were all... well you know doing what your doing now... ...shitting yourselves) shouldn't play in the shallow end of the gene pool. cancel me because I won't be back.
--> That's a big mistake, because you just attacked everyone here and you should know better than that. If you are old and wise then where are your manners?Quote:
Do you guys actually build internet sites and work with secuirty or do you just surf.
Maybe the knowledge level I'm looking for is beyond what a bunch of google searchers can handle.
--> That's just being a plain old *******. gore could be smoking weed and shooting up while working at BK for all I care, you ever go through and read some of his posts that have helped people? You see the rating and number of posts he has, he wouldn't have all that if he was such an uneducated person. To me I think you are the uneducated person who is probably some 16 year old who wants to try and be like the big kids.Quote:
2. Your panties are in a twist (mostly due to lack of real education) (gore)
And the list goes on, but come on. If you want help doing stuff fine, if we question you we are allowed since you're a newbie. You don't have total strangers walk up to you from off the street and ask you for tips on testing their security system on a house.
Hey though that's me, that's just what I thought I could be totally wrong *cough* looser *cough*
~AciD
It is interesting to go back through the posts in this thread and read the replies and look at the points that were thrown around.
A legitimate request for assistance quickly turned into a pathetic flame war with greenies tossed around for the best responses.
Maybe my reading comprehension is off...but I read his question as a request for suggestions on software for load testing, automation, and security testing tools for web applications. And since he was new to it, some information on methodology as well.
A few posts here were actually helpfull...although the tone of some of them was questionable. Maybe next time DocP should post some news articles that have been in every web site and mailing list first.....or write a few more tutorials on the osi model and batch files. He may get a warmer reception next time.
Juridian- I definately know what you're saying, but I don't think that anyone flamed him until he insulted the very community that he was requesting help from. And you should have seen the PM he sent me. If you thought his public post was rude, his PM was rediculous. Funny thing was, I was the first to respond, and was trying to help him.
He still has a point though. *hangs head down*
I love a good flame war once in a while. But I shouldv had better judgement and realised this person was not the flame war type who would be able to make a relevent arguement/flame. so for that I'm sorry, I admit i got out of line because I love being in a flame war. And even though he was a **** slut and threw accusations and assumptions at me that were hardly true, I AM a senior member and shouldv been more responcible.
I'm usually the first to admit when I'm wrong, but to get me to do that you also have to give me a chance to argue I'm not. Well this time I was wrong and here I am admitting I shouldn't have set out flame bait when the new fish in the pond is biting.
Sooo, I'm sorry to you and I dont have any harsh feelings to any of you. And I was wrong. Also J has a good point. I've seen 3 tutorials on the OSI model in like a week....isnt this overkill guys? I mean I didn't write my BSD install because I saw someone already had.
And, heh, I wouldn't shoot up, lol. Thats something I will NOT do. I'll stick with my vicodin and Xanax, I know what they do and I know how they work and why. After my degree is finished in computer science I might be going into pharmacology also. But I dont think so, but it's a possibility. Anyway I'm rambling on now. bye.
And I see that your post there was trying to be helpfull. Part of the problem is it's tone, mildly scolding him for not looking through the forums before posting. I understand what you meant, but it is very easy to take it the wrong way.
Not long after your post the whole thread seemed to go to hell with people screaming skript kiddie and other things that don't seem to relate to anything at all. Flaming is fun...but it has it's place. People need to calm down and think about what they are saying/reading before they post.
ps. I know what you mean about the pm crap....I get some interesting reading material every soo often.
wow, this thread is pitiful. Moderators, delete it now so that it doesn't scare newbies away.
<EDIT>Yes, I know im a newbie too ;)</EDIT>