Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
We have plans to deploy an Intranet application to the Internet. This will be running on IIS7.
Are there any tools which can simulate well known security attacks and give me advice on areas to improve? Would appreciate any good advice to stuffs I should watch out for.
It's not free, but McAfee Secure will run a scan against your site whenever you want that will identify any known security issues and check for SQL injection, cross-site scripting errors, etc. It will also look for common OS and web server vulnerabilities. When it's done it will give you a report with all of the problems and suggestions and links for more information on how to correct them. We use this service to scan our e-commerce sites as part of their PCI compliance requirements.
You can test the site with lcamtuf's RatProxy for potential vulnerabilities.
