Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

share|improve this question

closed as primarily opinion-based by HopelessN00b Dec 5 at 11:43

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I do want a white hat in, the problem I have is that the company is reluctant to spend the money. In order to get the funding I need to expose any vulnerability first (chicken and egg, I know) therefore I ideally need a free solution in the first instance. Any ideas? –  Marko Carter May 27 '09 at 13:38
    
on the windows stack? –  jinsungy May 27 '09 at 13:45
    
Yes, Windows Server 2008 Web edition using IIS7 for the host machine, talking to two databse servers (both Windows 2003, one with SQL 2000 and the other with SQL 2005) –  Marko Carter May 27 '09 at 13:52

11 Answers 11

up vote 7 down vote accepted

the whitehat consultants i've seen come in & use this tool then send you a massive bill.

Take a look at OWASP (Open Web Application Security Project) they're very informative & free! they have a very detailed pen-testing guide that you must look at.

share|improve this answer
1  
that's pretty expensive. –  jinsungy May 27 '09 at 14:13

Tools that I would use

Nmap Sister Tool SQLMap

and Nessus

also quick scanning for XSS and HTML Injection http://www.seoegghead.com/tools/scan-for-html-injection.seo also http://www.cirt.net/nikto2

Make sure you have looked at this during your development OWASP

You need to also check the Security Guidence from MS Windows Server 2008 Security Guide

share|improve this answer
    
The problem with Nessus is that the feed is no longer free unless you're a home user. nessus.org/plugins/index.php?view=feed –  K. Brian Kelley May 27 '09 at 16:43

McAfee Secure offers a pretty decent scanning service that will look at the web server, network, and the web site itself in an automated, on-demand way. Their scanner is certified for PCI scans, so it's pretty comprehensive.

share|improve this answer

Another option is Qualys. Keep in mind that Qualys and the mcAfee Secure solution are vulnerability scanners. Pen-testing can be automated with respect to scans, and some of it can be automated for XSS and SQL injection attacks, but ultimately, you'd want a reputable pentester checking the system.

share|improve this answer
    
I do want a white hat in, the problem I have is that the company is reluctant to spend the money. In order to get the funding I need to expose any vulnerability first (chicken and egg, I know) therefore I ideally need a free solution in the first instance. Any ideas? –  Marko Carter May 27 '09 at 13:38
    
Free? Start with the basics you can do yourself: nmap (nmap.org) to do a port and service scan and nikto (cirt.net/nikto2) to do a vulnerability scan. –  K. Brian Kelley May 27 '09 at 13:43

The first thing would be a network scan. Since you're on the windows stack, use zenmap and scan the webserver and both sql servers. This will tell you about open ports and services running. Run zenmap on the comprehensive test. I would use this info to tweak your firewall to block ports that are exposed.

Another thing you would want to do is look for SQL Injection vulnerabilities.

Scrawlr is a free software for scanning SQL injection vulnerabilities on your web applications.

It is developed by HP Web Security Research Group in coordination with Microsoft Security Response Center.

Check out this ScreenToaster video that I created. It demonstrates a simple network scan for sql server, port 1433, and a basic SQL Injection.

share|improve this answer

Top l0 list of Vulnerability scanners: http:// sectools.org/vuln-scanners.html

There's also Microsoft's Baseline Security Analyzer which should be part of your base setup if its not already before you deploy a server to prod: http:// www.microsoft.com/downloads/details.aspx?familyid=F32921AF-9DBE-4DCE-889E-ECF997EB18E9&displaylang=en

share|improve this answer

Nikto is a nice start to look for well known vulnerabilities. Works on Windows and Linux, etc. Simple enough even for noobs like me :)

share|improve this answer

Regardless of the technology you need to know the threats. You need to know what is the data that you are trying to protect? You need to know how your website works. Do a threat model first forgetting about these magical security bullet technology methods. You need to figure out where you are at before you spend wasteless money on a penetration test.

Matt Parsons CISSP mparsons1980 [at] gmail.com

share|improve this answer

Actually i'm the main creator of a new pentest LiveCD Distro, which is a fork of Backtrack 4. The Distro embbeds everything needed to make good penetration tests ( OpenVAS, Metasploit, fasttrack, milw0rm exploits...). Its name is shadowcircle, and you can check it out @

www.shadowcircle.org.

Hope you'll like it ;)

share|improve this answer

There is a variety of public license tools out there at your disposal, however, where I operate, we use Firefox and Paros Proxy to manipulate posts and gets, WebInspect for application vulnerablity reporting, and QualysGuard Enterprise for a good old fashioned hosts scan. Depending on what the results are, we make adjustments to the configuration and security posture of the box, create risk acceptance forms for things we cannot change, or engage other tools to decide whether or not a finding is actually something to be worried about.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.