Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Did you perform security scan on your web application?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Did you perform security scan on your web application?

seikanseikan Member
edited May 2012 in General

I'm a web developer and I believe many of you in LET are the same. Just wondering if you guys do security checks on your applications after it done?

I'm using skipfish (written by someone from Google) for the security scan. What are you guys using?

Thanked by 1inverse

Comments

  • Hm... Some acunetix kind of software :D
    Sometime using Norton and Virustotal

  • nabonabo Member

    @ErawanArifNugroho said: Sometime using Norton and Virustotal

    Wait, you test your own code against viruses?

  • Just some scanning if I missed that my code is somehow hacked by someone without knowing it :p

  • @nabo said: Wait, you test your own code against viruses?

    If your coding on Windows, good chance Windows is infecting all your pages with a virus.

    Thanked by 11q1
  • inverseinverse Member
    edited May 2012

    I've not seen skipfish - thanks for pointing it out! I will test this out over the weekend. I'm really interested in this sort of technology and have only really started looking into it.

    Have you seen Nikto? for testing your server(s) for vulnerabilities

    Thanked by 1mrm2005
  • nabonabo Member

    @Daniel said: If your coding on Windows, good chance Windows is infecting all your pages with a virus.

    Ok, might be true. I thought that anyone who's into coding has the slightest idea about how to use user-access-control in Windows how it's supposed to be. Maybe I'm wrong with that assumption :-)

  • seikanseikan Member

    @inverse said: Have you seen Nikto? for testing your server(s) for vulnerabilities

    Yup, I have tried Nikto and Watipi too :)

  • MrAndroidMrAndroid Member
    edited May 2012

    @nabo said: Ok, might be true. I thought that anyone who's into coding has the slightest idea about how to use user-access-control in Windows how it's supposed to be. Maybe I'm wrong with that assumption :-)

    No, but I had a friend who downloaded a program on Windows, didn't set off UAC or anything.

    Then all his HTML files started having java files in them when he made them and were infected.

  • nabonabo Member

    @Daniel said: No, but I had a friend who downloaded a program on Windows, didn't set off UAC or anything.

    Ok, well, so I must have been lucky the last 10 years :-)

  • @nabo said: Ok, well, so I must have been lucky the last 10 years :-)

    Im a Mac/Linux user and have been for 12 years, so I'm fairly unexperienced with Windows.

  • nabonabo Member

    @Daniel said: Im a Mac/Linux user and have been for 12 years, so I'm fairly unexperienced with Windows.

    Nice, well I've been using Macs when it was still called OS 7.x-9 but skipped when they went kiddie with the touch and bling. That being said, I'm still using Linux since my first Slackware install back in the days. However, I'm quite happy with Windows, besides that I need it for work. :-)

  • MrAndroidMrAndroid Member
    edited May 2012

    @nabo said: Nice, well I've been using Macs when it was still called OS 7.x-9 but skipped when they went kiddie with the touch and bling. That being said, I'm still using Linux since my first Slackware install back in the days. However, I'm quite happy with Windows, besides that I need it for work. :-)

    OS X Mountain Lion is going to ruin the developer community, so I probably will stop upgrading there.

    GateKeeper thing looks crap and theres hardly any details surrounding it. Does it enforce itself on binaries or .app's? If its based on binaries wouldn't that mean that all the software that comes with OS X thats not made by Apple (e.g. php, python, ruby, sedarwin, bsd, apache) also requires a certificate?

  • AldryicAldryic Member

    You guys know we have a user that does this for a living, professionally, right? Toss @vld a line, his company already does high level corporate and government contracts... he's helped us tremendously with security audits on Stallion and billing, and I'd trust his word over an automated scanner any day.

  • yomeroyomero Member
    edited May 2012

    @Daniel kinda DRM in other words.

    Nikto scans for web vulnerabilities? IIRC is just for scanning vulnerabilities in the software platform.

  • netomxnetomx Moderator, Veteran

    @yomero said: @Daniel kinda DRM in other words.

    Nykto scans for web vulnerabilities? IIRC is just for scanning vulnerabilities in the software platform.

    stupid comment. I don't even Thanked it.. maybe @yomero hacked my account...

  • @netomx said: tupid comment. I don't even Thanked it.. maybe @yomero hacked my account...

    @yomero has one of those stupid Thanked by xxx signatures.

  • yomeroyomero Member
    edited May 2012

    @netomx said: stupid comment.

    Wow.
    So, just stupid, because what?
    And what's the need of the aggression?

    If I read here http://cirt.net/nikto2 is about scanning the web server, no the web applications.

    @dmmcintyre3 said: has one of those stupid Thanked by xxx signatures.

    Fixed

    Edit: Hopefully this link can help us
    http://projects.webappsec.org/w/page/13246986/Web Application Security Scanner Evaluation Criteria

  • djvdorpdjvdorp Member
    edited May 2012

    Nikto, Acunetix and Metasploit ftw :)

  • 1q11q1 Member

    no

  • @djvdorp : Metasploit :p

Sign In or Register to comment.