Where can I get a security code review for free?

Question

Dear Abby,

I've been working on a PHP website which utilizes a MySQL database (using PDO). I would just like to know it is secure before I go ahead and release it to the public. It is a free, non-profit website so I don't really plan on making money from it and therefore I would rather not invest hundreds or thousands of dollars for a security audit.

I know there are tools from http://owasp.org and other organizations but I can't say that I have enough time or energy to cover all my bases even with resources like this.

Ideally I would like to take care of any major holes right off the bat and then make small improvements over the course of its lifetime. I also don't feel comfortable just blatantly posting all of my code around the internet for everyone to see.

What can I do?

Edit: The point is that I would like suggestions on where my code may have flaws in it and how to fix it. I already have a good deal of security experience but I am not able to honestly say that I am patching bugs the correct way unless someone who knows what they're doing takes a look at my code.

Answer 1

post a message on a hackers board saying that your website can not be cracked.. you'll have response soon enough. make sure you are on a dedicated server though ;-)

edit: also see my comment below..

Answer 2

Use a freely available web scanner tool. Here's a list of some popular ones: Top 10 Web Vulnerability Scanners

This will at least get you started - though it's certainly not an acceptable replacement for a full security audit if your application NEEDS to be secure. You'll need to pay money for a real audit, though.

You may find the OWASP site helpful as well.

Answer 3

You can use the Firefox plugin suite by Security Compass. Also, the forum at PHP Freaks also has a section where you can ask others to try to hack your site.

Answer 4

Find smart folks that know web application security, specifically with respect to php/MySQL. Ask them to code review. The scanners are good, but they will miss some things. Because you are doing this for a non-profit, I'm sure there are some security researchers who will be sympathetic to the cause of the non-profit who will donate time accordingly, just as you basically are.

Answer 5

You should cover the major 'bases' in regards to web application security:

• [SQL Injection] - Make sure you use parameterized SQL Queries, not just string concatenation. i.e. This is bad: "Select Login FROM Users WHERE Login = '" . $_POST['Login'] . "'"
• [XSS] - Make sure if a user puts in something like this: <script>alert('hi');</script> into one of your fields, it doesn't cause a javascript alert when you display that on a page. Escape data that may have come from a user before outputting: echo h($variable);
• [CSRF] - Try to keep anything things out of cookies, use tokens that can be validated on form submissions (this is a bit harder to demonstrate on 1 line).
• Cookies, hidden fields or anywhere else exposed to the user is not a good place to put anything important or anything that provides access to something.
• Keep your servers all patched up and backed up.

These are just a few things off the top of my head, they are no where near all inclusive. Also, keep in mind that security is something that you need to work on through the entire time you are developing an application. It isn't something that just gets reviewed at the end of a project. Also, keep learning and reviewing various hacking methods - they are continually creating new ways to hack, we need to continue to keep vigilant and modify how we program to keep things secure.

Answer 6

Don't be afraid to post your code all over the internet. Your site is not up yet, so anyone who finds a hole and tells you is a good guy. More eyes on your code is a good thing.

Answer 7

OWASP Open Review Project will review all code that is released as open source...

Answer 8

send a mail to [email protected]. if you are hosting a non-profit site, they might audit your site for free.