0

My employer has used an external consultant for penetration testing. The web development team not involved in the pentesting itself and we only received the results and suggestions on how to improve security, so I am not experienced in pentesting tools and methodology.

I'm now working on a website development privately and can't afford external pentesting at this stage. The website will contain a MySQL database with customer data. Payments will most likely be handled by using a third party to process them. I've begun researching some online pentesting tools, particularly in relation to SQL.

Are there specific tests, or a checklist, guide or standard methodology for testing the security of websites, which many consultants would follow as a minimum? Obviously this should be free-to-distribute material, not proprietary.

I fully appreciate that self-testing will never replace the expertise of a security consultant but I would like to try to do as much myself first and may eventually ask a consultant to perform further testing before we go live if appropriate.

  • Apologies that the original question was vague and phrased to seek opinions rather than clear factual answers. I have now updated the question. Hopefully this now fits within the guidelines. – RixN Aug 11 '19 at 17:08
  • This is a much better question and better focused. Thanks for the edit. It is still pretty broad and still asking for recommendations, so it's difficult to answer. What I can say is to look at OWASP. They provide the "specific tests, or a checklist, guide or standard methodology for testing the security of websites, which many consultants would follow as a minimum". Start there and you will likely have everything you need to get started until you need more specific help. – schroeder Aug 11 '19 at 19:58
5

There’s an old joke variant that runs something like this:

A major newspaper had a sudden problem with their normally reliable high speed printer. When they couldn’t quickly fix it, someone said that “Charlie” was the master of that particular printer.

“Well where’s Charlie?”

“He retired last week.”

“Bring him in under special contract!”

Charlie came in, walked around the machine staring at it for 10 minutes then put a chalk “X” at one spot. “Hit it with a hammer right there.”

They hit the “X” and everything began working.

Charlie said, “That will be ten thousand dollars.”

“What, that’s outrageous! All you did was make a chalk mark. I want an itemized invoice.”

Chalk – $1.00

Knowing where to put the “X” – $9,999.00

               ----------------------

In short, it’s not the tools, it’s the expertise.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.