An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

10
votes
6answers
3k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
19
votes
4answers
5k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
9
votes
2answers
872 views

Cross site scripting verification on a field which does not accept more than 20 characters

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
3
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications? [closed]

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
4
votes
2answers
3k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
8
votes
4answers
537 views

Is it practical and worthwhile to alternate penetration test vendors?

Is it considered a best practice to alternate the vendor used to perform penetration tests? For example if it is your policy to conduct a third-party penetration test semi-annually you would have ...
14
votes
2answers
1k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
4
votes
0answers
659 views

Best website to learn computer security basics? [duplicate]

Possible Duplicate: Resources to learn about security Can someone advice on which are the good sites out there to learn the basics of computer security from?
12
votes
4answers
213 views

Is external vuln scanning sufficient?

Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it? From the original Area51 proposal.