Is there any easy to use PHP Security Scanner? Thanks a lot
A:
Yes, very good one:
Acunetix WVS automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.
Sarfraz
2010-06-16 18:37:52
A:
# # ####### #####
# # # # #
# # # #
# ##### #####
# # # ###
# # # # ###
# ####### ##### ###
mcandre
2010-06-16 18:38:38
+6
A:
Please be aware that NO automated security scanner will be able to detect all vulnerabilities in the code base. The best way to protect your code is to learn about how to write secure software, and do diligent code reviews.
Note, I'm not saying NOT to use a scanner. I'm saying use a scanner as a second line of defense only. Don't rely on it to make up for poor coding practices...
ircmaxell
2010-06-16 18:41:13
Im agree with you. But there are always hackers that smarter than us!!
phpExe
2010-06-16 18:45:51
Well, the hackers (the smarter ones that you allude to at least) would likely be using something that they wrote to scan for vulnerabilities that check for things that the generic ones don't (or have different/better/newer methods). So even a commercial scanner may not save you there...
ircmaxell
2010-06-16 18:50:05
@ircmaxell, Thanks for advise. Im try to write code secure but I dont want to to be exposed to 14 years old kids :)BTW I cant pay $ 1445 for this! I will try mcandre's link.
phpExe
2010-06-16 18:58:48
@phpExe Sounds like you need to hire that 14 year old kid ;)
Rowland Shaw
2010-06-20 11:01:49
@Rowland Shaw; Can you give address of the kid that you "hire", please?Sounds like that you have experience about hiring hackers ;)
phpExe
2010-06-20 20:07:47
@phpExe My point is more that if you're not confident in your abilities to be hacker proof, then it's probably worthwhile hiring someone with more experience, either proven in industry with a CV, or otherwise.
Rowland Shaw
2010-06-21 08:02:50
@Rowland Shaw, Im confident in my abilities to be hacker proof shortly. BTW, This is not related with my topic. I can see attacks in very big sites. No body is untouchable, even you or any hacker or any "king of programmers" ;)
phpExe
2010-06-21 09:08:23
The first thing you must understand, is there is no such thing as a perfectly secure computer. If someone wants it bad enough, they can get in. Whether it involves kidnapping you to get the passwords, physically stealing the server or getting through a trusted computer, it's always possible. The whole point of security isn't to make it hacker proof, but make it hard enough that "hackers" don't want to put forth the effort necessary (unless they are really motivated).
ircmaxell
2010-06-21 11:02:27