How to attack my own site?

Question

I'm currently working on security for a website (JSP) that contains 2 pages: login and data page. Once a user logs in, they can select data from a specific table with read-only access.

After looking at Internet security threats, I wrote down a general list of what I might need to protect against

• Injections
• Xss
• authorization / session capture
• CSRF
• Direct object ref

I am currently reading about how to protect these attacks and what I should include in my code. However, I will not know if my code really works if I do not test these attacks for myself (and even then there may be other attacks that work). Right now, I just want some security, and so I need to know how to produce these attacks so that I can try them on my site.

The injections were simple, since all I had to do was type '1' = '1 in my code to show that it was erroneous. Then I used the prepared statements and the SQL injections no longer worked.

How can I reproduce the rest of these attacks to make sure my security is still working against the main attacks?

(Also, maybe some secure site or tool that I can use to check my vulnerabilities?)

Answer 1

I assume from your list that you are watching the Open Web Application Security Project Ten Ten . Good!

Indeed, the best advice I can give is reading through the OWASP website. A good first step would be to go through the individual links on this page (for example, Broken Authentication and Session Management ) and check "Am I vulnerable?" section. Here are some more tips:

Xss

A screenshot of XSS can be very useful. More examples than you can shake a stick ready to paste on your site.

CSRF

There is a CSRF Testing Guide on the wiki wiki which contains great links and suggestions.

Hold Authorization / Session Capture

Ok, are you using HTTPS? See more details.

Additional Resources

If you want to go deeper and do some real testing, follow these steps:

• Read the Hacker Application Guide for Web Applications .
• Try the examples from http://hackthissite.org and the Google Gruyere Project and see if you can break them down.
• Download Kali Linux and learn how to use some of the tools that come with it.
• Go to a security conference or mini-conk near you and connect with other infosec users. Maybe I will see you there :)