   Automated hacking tests for websites
  I'm nearing the release of a website I built and am getting increasingly paranoid about how well it will stand up against hackers, bots, etc. once it becomes available on the internet. It's based off Php, MySQL and &#106avascript which is pretty common, and I've read tons of articles about how most malicious hacks successfully penetrate security. I've gone with the 'be completely paranoid about everything' mindset when it comes security measures, but the more I learn, the more I know that I cannot have not safeguarded myself against every type of threat.So, my question has two parts. How do I best test my site for security holes before I make it public?Are there automated services that will basically attack my site in an automated way and give me a security assessment on what passed and what failed? Probably wishful thinking, but I don't want to learn the hard way...   
  The short answer is "No."1. The security threats and vulnerabilities are always changing. Every patch, update, release of popular software would require the owner to revise their "hacking code".2. Why would a (blackhat) hacker go through the effort to maintain a website which threatens his "job" by showing sys admins the vulnerabilities in their systems?3. Think about this: Lets say that someone actually goes through the effort to maintain a website which does indeed "hack test" a website in various ways, for every possible platform and version. What is their business plan for operating such a website? Ad revenues? security consulting? the chance to sell you some "anti-virus" softwares? Can you trust them to be completely thorough with their tests?You'll have to read the manuals for the corresponding tech platforms and make sure that your code is as reasonably secure as possible. That means sanitizing any URL parameters which may be inserted/read by your mysql database (SQL Injection attack), securing your webserver (if you control it), securing PHP, and... &#106avascript is not a security threat since it runs on client-side within a browser. Again, read the security sections!! ...and please don't do anything dumb like storing your root database password in clear text somewhere on your site which is publicly accessible...Also, while "security through obscurity" isn't a good security practice at all, I'll dare to say that you don't have to really worry about serious targeted hack attempts unless your website has high traffic and high visibility. Most attempts will be script kiddies doing port scans to find vulnerable machines and unpatched exploits.So, take this away as a conclusion: Anything connected to the internet may be vulnerable to being hacked one way or another. There is no such thing as 100% security apart from physically disconnecting yourself. Do security practices within practical reason to the threat your facing, sensitivity of your data, exposure to the network, and cost of implementation.   ;  Unfortunately no, I don't believe there is any automated software to do this.The biggest thing you'll probably need to watch out for is SQL injection.  Double-check all of the "entrypoints" for user input inside your PHP files:  look at where you're extracting information from a GET or POST request.  Ensure that any data that may be passed to a database has been run through the addslashes() function, if you don't have magic quotes turned on.The best thing you can do is to try and hack it yourself.  Since you know all of the possible entrypoints for SQL injection, try and find a way to "break" your server side code from the client side.  Whether this means fooling with the URL for a GET request, or messing with the internals of a POST request, just try and find some way to get the server-side code to misbehave.Check to make sure that the software on your server (PHP/MySQL) are the newest STABLE versions and you should be OK.  If your website is transferring sensitive data over the net, you should use SSL.;  There's probably no "automated" tests, but you could get in to the hack challenge circle and see if anyone would be willing to test it for you.  Most of the sites have active forums and IRC.  My favorites are hackquest.com and mod-x.com .   ;Quote:Original post by blueEbola[...]The biggest thing you'll probably need to watch out for is SQL injection.  Double-check all of the "entrypoints" for user input inside your PHP files:  look at where you're extracting information from a GET or POST request.  Ensure that any data that may be passed to a database has been run through the addslashes() function, if you don't have magic quotes turned on.[...]"addslashes" is not designed to create safe SQL statements, you need something specific such as "mysql_real_escape_string". Personally, I suggest using PDO, which automatically escapes arguments correctly for any database system.   ;  Escaping slashes? Why does anybody ever do any of that? Prepared statements. Period. Use prepared statements and there will be no such thing as SQL injection and also your queries will be faster.   