C# Security Testing
White-Box testing is testing the system based on the internal perspective of the system.In this case, this is also known as Static Analysis. These tools can find issues with the source code before the code is actually executed.
Zed Attack Proxy (ZAP) – The short guide
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners [...]
Zed Attack Proxy
The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks
Directory Buster
Another great security tool from the Open Web Application Security Project. Asides from worrying spelling in a lot of these open source projects (“Responce”??), there is little gem to identify hidden pages/directories and directories with a web application, which highlights possible security holes (an emailer script in unused page for example). This can be used [...]
Skipfish
Now onto another command line based security testing tool called Skipfish. You can download and compile source, or yum for package (yum install skipfish). Now navigate to a directory where you want to output results directory to be created (or you can enter specific path in the command string). The Skipfish help page gives you [...]
Zap Website Security Testing
OWSAP ZAP is a useful website security testing tool, that any web savvy tester could use effectively. Apart from the annoyingly vague setup (ensure first task is to set up your browser to use same proxy as defined in ZAP), there are useful tools that you can start at a click. I ran the “Active [...]
TamperData
Oh, I like this – a great tool for any web tester, and a better alternative to using CURL to manipulate POST/GET http data. TamperData is an Firefox extension to track and modify http/https requests. It is ideal to common more lightweight security issues, which are important to consider, given the amount of amateur hackers, [...]
