First thing first; this is something I have never done before.
I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an Ubuntu instance configured all by my self.
Now I have a very critical "must" perform requirement to see the security holes of this application. I have been asked to do Penetration test on this.
I have below questions.
When performing this test, do I have to do in my live application or in the application running in my local machine (localhost) ?
I found bunch of online tools which only accepts an URL and do the test. These tools are recommended and professional ?
What are the recommended tools available for Java web application penetration test? Are they "software" or kind of "API" where I have to program the entire test spending lot of time?