7
votes
3answers
2k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
3
votes
5answers
209 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
1
vote
2answers
232 views

What is the first step in auditing the security efficiency of a simple website?

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security. I am wondering from where to start? Is there a famous audit forms to analyze and ...
1
vote
3answers
1k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
15
votes
3answers
421 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...