1. What knowledge is needed?
  2. What software is to be used?
  3. How are the reports written? PS: Websites like facebook.com
  • 2
    This has been asked in several questions before, please try to do a simple search. – Lucas Kauffman Mar 31 '13 at 7:42
  1. General knowledge about how applications work and how to introduce atypical or unexpected behavior into the application that might pose a security threat. Please refer to the OWASP testing guide. https://www.owasp.org/index.php/OWASP_Testing_Project
  2. Depends, there are a lot of tools like Zap, Burp, BackTrack and of course homebrew scripts.
  3. That entirely depends on the tester, I've seen bad reports, I've seen good reports. Mostly you try to: describe the vulnerability, describe the risk and give a recommendation. You also rate the impact and probability such a vulnerability would actually be exploited.

Not the answer you're looking for? Browse other questions tagged or ask your own question.