-9

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website while it still has dummy data and doesn't matter if I lose any information. I can always just destroy the server and start again.

I was wondering if there were any books that ran through the process of hacking a website? I am familiar with protecting against SQL injection attacks but not quite so familiar about click jacking, cross site scripting and other related vulnerabilities which are common on websites. I need to be able to exploit them on my own website so I can understand how to protect against them on the back-end.

Unfortunately I have no books on these subjects and have no idea where to start. How did you get going with website security? How do you ensure your website is free from exploits when you deploy it to production?

Improve this question
1
  • 1
    As a rule of thumb, you should assume that you will miss issues when you do your own pentesting; even more so if this is your first one. Start by asking a more experienced colleague to review your code. Depending on your budget and threat profile, you might be well advised to hire a friendly security analyst who doesn't mind you observing them during the work and asking many questions. From their POV, teaching you is extra work, though, and you should expect to have to pay extra for it.
    – dig
    Apr 3, 2018 at 15:33

2 Answers 2

Reset to default
3

As a starter OWASP is always good. You can also find some tools there. Check the cheat sheet series too.

Improve this answer
2

This is a book on BASIC pentesting of webapps :

http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166

I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .