4 ms·

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves lookin

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). If you're trying to determine the hardness of your machines against known vulns there are two free (oss?) programs I'd recommend: Nessus and Snort. That may buy you time until you get big enough that you have something more than script kiddies knocking at your server's doors.

ca98am79 18y ago
thanks for the feedback and the suggestions. yeah, I figured I would have to do something like this, but I am paranoid and thought I would ask in case there was another better option.
dguido 18y ago
> there are two free (oss?) programs I'd recommend: Nessus and Snort Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner! To the OP: If you want to test your website for security flaws, you can do the following (in no particular order): - Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 http://www.owasp.org/index.php/Top_10_2007 - Request a free scan from Qualys: http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6390 http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6... - Download and run w3af: http://w3af.sourceforge.net/ http://w3af.sourceforge.net/ - Buy Burp v1.2 (when it comes out, soon. it's only about $150) and run Burp Scanner: http://portswigger.net/suite/ http://portswigger.net/suite/ - Download Acunetix for a free XSS scanner: http://www.acunetix.com/cross-site-scripting/Copy-scanner.htm http://www.acunetix.com/cross-site-scripting/Copy-scanner.ht... - Download SQLiX for a free SQL injection scanner: http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project - ratproxy is a largely passive web application security audit tool: http://code.google.com/p/ratproxy/ http://code.google.com/p/ratproxy/ and http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ - Test it by hand yourself: OWASP Testing Guide: http://www.owasp.org/index.php/Category:OWASP_Testing_Project http://www.owasp.org/index.php/Category:OWASP_Testing_Projec... OWASP Guide to Building Secure Web Applications: http://www.owasp.org/index.php/Category:OWASP_Guide_Project http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP AppSec FAQ: http://www.owasp.org/index.php/OWASP_AppSec_FAQ http://www.owasp.org/index.php/OWASP_AppSec_FAQ > Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). Dude, wrong again. The OP probably doesn't have an overly complicated website given that its just him and his buddy coding for a startup. An expert will likely estimate the amount of time it takes to test his website in a matter of [single-digit] hours. Also, webapp testing is the least expensive type of security testing there is.
- ca98am79 18y ago
  awesome - thanks very much for your help

ca98am79 18y ago

thanks for the feedback and the suggestions. yeah, I figured I would have to do something like this, but I am paranoid and thought I would ask in case there was another better option.

dguido 18y ago

> there are two free (oss?) programs I'd recommend: Nessus and Snort Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner! To the OP: If you want to test your website for security flaws, you can do the following (in no particular order): - Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 http://www.owasp.org/index.php/Top_10_2007 - Request a free scan from Qualys: http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6390 http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6... - Download and run w3af: http://w3af.sourceforge.net/ http://w3af.sourceforge.net/ - Buy Burp v1.2 (when it comes out, soon. it's only about $150) and run Burp Scanner: http://portswigger.net/suite/ http://portswigger.net/suite/ - Download Acunetix for a free XSS scanner: http://www.acunetix.com/cross-site-scripting/Copy-scanner.htm http://www.acunetix.com/cross-site-scripting/Copy-scanner.ht... - Download SQLiX for a free SQL injection scanner: http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project - ratproxy is a largely passive web application security audit tool: http://code.google.com/p/ratproxy/ http://code.google.com/p/ratproxy/ and http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ - Test it by hand yourself: OWASP Testing Guide: http://www.owasp.org/index.php/Category:OWASP_Testing_Project http://www.owasp.org/index.php/Category:OWASP_Testing_Projec... OWASP Guide to Building Secure Web Applications: http://www.owasp.org/index.php/Category:OWASP_Guide_Project http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP AppSec FAQ: http://www.owasp.org/index.php/OWASP_AppSec_FAQ http://www.owasp.org/index.php/OWASP_AppSec_FAQ > Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). Dude, wrong again. The OP probably doesn't have an overly complicated website given that its just him and his buddy coding for a startup. An expert will likely estimate the amount of time it takes to test his website in a matter of [single-digit] hours. Also, webapp testing is the least expensive type of security testing there is.

ca98am79 18y ago
awesome - thanks very much for your help