Web application security testing

Question

Hi all,

We are developing a web application using Spring framework and Hibernate ORM. As far as application security is concerned we are using acegi to provide authentication and authorization support.

Now about user input sanitation, we have tried to take take care about attacks like XSS and sql injections. We have tried to use as much as prepared statements and hibernate criteria for database updates and queries. Inputs are sanitized for javascript also.

For testing these we have tried to use tools like Firebug, Tamper IEand Fiddler2 etc.

We have also used tools like Watch Mouse to do vulnerability tests.

What are the other tools available for web application security and what are the things to be considered before starting a web applications security testing.

Thanks you

Answer 1

HP has a security assessment tool called Webinspect, but it not free and I wouldn't recommend it. Either my company doesn't know how to use it, or the tool has no consistency in finding vulnerabilities.

Answer 2

You're better off hiring an actual pen-testing contracting agency to look for vulnerabilities in your site. Sure, you could run automated scanners, but they can only do so much. You'll probably waste more money and resources attempting to learn and implement proper pen testing then you would just hiring someone else to do it.

The fact that you're asking this question means that you are not qualified to give the kind of confidence or complete coverage a commercial application would need before launch.

Answer 3

Burpsuite is an amazing tool for web application testing.

I do agree with hiring an outside team however, but if your company cannot/will-not, put a weekend into getting familiar with BurpSuite and you will undoubtedly find some bugs.

Answer 4

You can use AppScan, but its not free.