Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there some established community that I can expose a test instance of my product to in order to test the security? Or has anyone had any experience organising a public "hack my server" session?

share|improve this question

closed as not constructive by Ward, Tom H, Wesley, mgorven, Skyhawk May 28 '12 at 23:04

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Advice on where to test it and how, depends on what your product is? Do you want the code tested, because it's something you've written your self? – jwbensley May 28 '12 at 21:37
Put it live and post the URL to 4chan along with the phrase "Do your worst." – SmallClanger May 28 '12 at 21:47
@SmallClanger, that's a good one! – HTTP500 May 28 '12 at 21:51
Some more detail would be appreciated. I also suggest looking around on – Lucas Kauffman May 28 '12 at 22:03
The best way to get it hacked would be to place it on the Internet and wait a little while. :) – John Gardeniers May 29 '12 at 0:45

What you're looking for is a combination of penetration testing and code security review.

There are a lot of companies and freelance individuals who will do a pentest for you, for a price. Depending on what you're trying to secure (webapp, payment gateway, physical box, hosted VM, entire network, etc) there may be certain regulations which need to be followed. You'll also have to liase with your hosting provider, since they don't like random people sniffing around in their network.

A code security review, on the other hand, requires in-depth knowledge of your codebase and security concepts, so most companies hire a security developer (or contract one in) for this kind of role. They'll need to get comfortable with your entire application and network, then do a detailed analysis of any potential security issues within the code or infrastructure.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.