Results 1 to 7 of 7

Thread: Web Vulnerability testing for the Non-technical

  1. August 1st, 2006, 04:43 PM #1
    zencoder
    zencoder is offline
    AO Senior Cow-beller
    Moderator     zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177

    Question Web Vulnerability testing for the Non-technical

    Does anyone know of a resource, site, or service that a person could use to scan their commerce webserver for vulnerabilities? I'm talking about something like that ShieldsUp stuff from GRC.com...something a non-technical website owner could use to verify the security of their site?

    I know, I'm asking a lot. I don't believe such a thing even exists, but I figured the group would have more knowledge towards that fact that I would myself. I'm being interviewed for a news article and was asked this question (pre-interview questions, how nice of them) and honestly, I have no clue.

    I know that there are serious implications for the host/owner of any such service, the first and most obvious two being #1 how do you know a malicious party isn't using your tool to do recon on target websites, and #2 how do you know a malicious party isn't using your tool to DOS a target website?

    Any thoughts, input, or links would be appreciated.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore
    Reply With Quote Reply With Quote
  2. August 1st, 2006, 04:59 PM #2
    brokencrow
    brokencrow is offline
    Dissident 4dm1n brokencrow's Avatar
    Join Date
    Feb 2004
    Location
    Shawnee country
    Posts
    1,243
    Try these guys, zen:

    http://securityspace.com/sspace/index.html

    It's been awhile since I used them. They have free trails, you'll need to register.
    “Everybody is ignorant, only on different subjects.” — Will Rogers
    Reply With Quote Reply With Quote
  3. August 1st, 2006, 05:21 PM #3
    Negative
    Negative is offline
    Banned
    Join Date
    Aug 2001
    Location
    Yes
    Posts
    4,424
    There's also ScanAlert's "Hacker Safe" "certificate"
    Reply With Quote Reply With Quote
  4. August 2nd, 2006, 03:37 AM #4
    Soda_Popinsky
    Soda_Popinsky is offline
    Join Date
    Nov 2003
    Posts
    1,426
    WebInspect by SiteDynamics, Wikto by Sensepost, Nikto...

    WebInspect can really suck on certain types of sites, and none will do better than manual or partially automated source review. WI isn't free
    Reply With Quote Reply With Quote
  5. August 2nd, 2006, 05:22 PM #5
    Lv4
    Lv4 is offline
    Senior Member
    Join Date
    Mar 2003
    Posts
    372
    I'll second the ScanAlert folks. We have used them at my last two jobs... even my CIO (completely non technical) could handle those scans

    Give a man a match and he will be warm for a while, light him on fire and he will be warm for the rest of his life.
    Reply With Quote Reply With Quote
  6. August 2nd, 2006, 08:39 PM #6
    rapier57
    rapier57 is offline
    Banned
    Join Date
    Apr 2003
    Posts
    1,146
    I know you want non-technical, but the OWASP site should be bookmarked and referenced once in a while. The .pdf web development guide is priceless.

    http://www.owasp.org/index.php/Main_Page
    Reply With Quote Reply With Quote
  7. August 5th, 2006, 08:45 PM #7
    zencoder
    zencoder is offline
    AO Senior Cow-beller
    Moderator     zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    Thanks guys, you're input was all helpful. Much appreciated, and I'll share the results later, when they are public.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules