How To Perform a Security Test on A Website?
Performing website security tests can be tricky if you don’t know what to look for. However, by following the steps below, you can create an effective and efficient security testing plan to make sure your website is secure from cyber-criminals. What Is Security Testing? First off, it’s important to have a clear understanding of what security testing entails so that you know what you should be looking for when conducting your own security tests.
Get your tools together!
Before you start testing, you’ll need to assemble a toolkit. Each website’s security needs will be different, but a good place to start is by using: Paros/ParosPro – Web application penetration testing tool that allows users to crawl and analyze a website in order to find security vulnerabilities. The free version gives your basic vulnerability information and data on issues with cross-site scripting, SQL injection and directory traversal.
Check for visible security issues
Visible security issues, such as broken HTTPS, domain typos and sensitive content in source code are easy to spot. Check each page of your website for these things with manual tests. If you want to go deeper than a visual test—for example, if you want to run automated scans— you can do that with a paid tool like Whitehat’s Site Auditor
Hack through the login
One of the easiest ways to spot security holes is to simply try logging in as a hacker. Try every username you can think of, every password that could possibly exist and every username with each password. When that doesn’t work, try another user account, or maybe even multiple users if your site has them.
Scan for Backdoors
Backdoors are probably first on your list. These are vulnerabilities that allow a hacker to gain remote access to your server, whether you have a firewall in place or not. The most common backdoors are RFI (Remote File Inclusion) and LFI (Local File Inclusion). RFI allows hackers to pull code from other sources, while LFI lets them put their own code into yours.
Find out if there are any Logfiles
The first thing you’ll want to do is find out if there are any logfiles being generated on your site that can help identify where users are getting stuck or what they’re struggling with. An easy way to check for these logs is by running a Google search of your domain name followed by .log. If anything, relevant turns up, download them and analyse their content.
Check if Sensitive Information Is Shown in Plain Text
The first thing you should do when performing a security test on a website is search for sensitive information. This means searching for things like Social Security numbers, bank account numbers, and so on. You can do this with Google and other search engines. Search for ssn 123-45-6789 or similar terms to see if any pages reveal sensitive information in plain text rather than encrypted form (using HTTPS).
Change Default Passwords to Strong Ones
This is a great first step in security testing your website. Simply changing default passwords to something you’ve created will help to keep intruders out of your site and keep your site more secure.
Look for Any Cross-Site Scripting (XSS) Vulnerabilities
There’s a possibility that your website will have an XSS vulnerability. Since there are many ways that these vulnerabilities can be introduced, it’s best to use a vulnerability scanner like Acunetix to find and fix any existing XSS bugs. If you don’t want to purchase or use a tool, you can also try using manually checking your site for XSS issues.
