Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  1. What knowledge is needed?
  2. What software is to be used?
  3. How are the reports written? PS: Websites like facebook.com
share|improve this question

closed as not a real question by Lucas Kauffman, AviD Mar 31 '13 at 8:59

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
This has been asked in several questions before, please try to do a simple search. –  Lucas Kauffman Mar 31 '13 at 7:42

1 Answer 1

up vote 1 down vote accepted
  1. General knowledge about how applications work and how to introduce atypical or unexpected behavior into the application that might pose a security threat. Please refer to the OWASP testing guide. https://www.owasp.org/index.php/OWASP_Testing_Project
  2. Depends, there are a lot of tools like Zap, Burp, BackTrack and of course homebrew scripts.
  3. That entirely depends on the tester, I've seen bad reports, I've seen good reports. Mostly you try to: describe the vulnerability, describe the risk and give a recommendation. You also rate the impact and probability such a vulnerability would actually be exploited.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.