坛子哪位大牛有做pentest或者被pentest的经验吗？

gooderic1977

加分求web app pentest 涵盖的内容。

公司order了两个星期后的pentest。99%的网站是过不了pentest的。

说实话，从来没那么紧张过啊。。。。如果report太难看的话，作为dev很没面子的说。。。。

牵黄擎苍

自己下载个metasploit先做做看，心里有个底

stock99

nessus (home edition ) -> provide some sql injection test capability.
sqlmap (come with kali linux or backtrack)  -> this should cover your one of your biggest embarrassment.  go search youtube or securitytube on how to use it.

Burp pro, (non-free version : 3-400 dollars) -> cover basic injection (javascript and sql injection and command injection capability).

make sure your OS patch up-to-date(windows update or apt-get or yum ,etc)!!  Otherwise , if your web application suck, pentester can do easily privilege escalation and pwn the box to become root/administrator. you gona look real bad...

====================
make sure no bad injection in your web app
====================
make sure your data and sql routine are separated.  
https://www.owasp.org/index.php/ ... vention_Cheat_Sheet

make sure your web application to output encoding.  [use esapi library]
https://www.google.com.au/search ... mp;client=firefox-a

command line injection (use esapi to help you for input validation) . On some cases, this can lead to arbitrary command execution on your OS !
https://www.owasp.org/index.php/Command_Injection


=================
no weak session management
================
Cross site request forgey (CSRF) must not be possible at login page.
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
session fixation must not be there at login page.
https://www.owasp.org/index.php/Session_fixation

===================
other finding
===================

Secure cookie set? Http-only set?
http can't protect your sensitive information from sniff attack (man in the middle).  Does your https strong enough? Test ssl cipher strength:  http://www.bolet.org/TestSSLServer/  
check any web directory that is not for production purpose. disable for access.
check your authentication. Make sure

#####
Last but not least, usually people test for owasp top 10.  

https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

If your web application use web services, make sure you cover NO LESS than web page design for browser!!

Below is the owasp testing guide. A little outdated , but can be use as a reference to understand the important concept.
https://www.owasp.org/index.php/ ... WASP_Testing_Guides  

This is the new backtrack linux distribution. Which come with metasploit.  There are many tools inside this linux distro.  Most pentester use this are other custom make tool.
http://www.kali.org/
#####
The above are the common finding I see.  Go through the owasp top 10 category of test. Let me know if any area you feel your web application make be weak. we can talk more on that.