Ask YC: "Hacker-testing" service?

#1

Post by ca98am79 » Wed, Dec 03, 2008, 11:00 PM UTC

I've been working on a web startup with one other co-founder, and I am the only programmer. I try my best to make things as secure as I can, but it is always better to have another set of eyes looking over things to make sure I am not overlooking something obvious. Is there any security-auditing or "hacker-testing" services you would suggest that we can use? We're willing to pay something for this, but we don't have a lot of extra cash to throw around right now.

If you can't think of any services like this that you would use, what would you do in my place? Any advice is greatly appreciated - thank you!

Re: Ask YC: "Hacker-testing" service?

#2

Post by aaroneous » Wed, Dec 03, 2008, 11:29 PM UTC

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming).

If you're trying to determine the hardness of your machines against known vulns there are two free (oss?) programs I'd recommend: Nessus and Snort. That may buy you time until you get big enough that you have something more than script kiddies knocking at your server's doors.

Re: Ask YC: "Hacker-testing" service?

#3

Post by ca98am79 » Wed, Dec 03, 2008, 11:47 PM UTC

aaroneous wrote: post #2

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). If you're trying to determine the hardness of your machines against known vulns there are two free (oss?) programs I'd recommend: Nessus and Snort. That may buy you time until yo…

thanks for the feedback and the suggestions. yeah, I figured I would have to do something like this, but I am paranoid and thought I would ask in case there was another better option.

Re: Ask YC: "Hacker-testing" service?

#4

Post by dguido » Thu, Dec 04, 2008, 12:48 AM UTC

aaroneous wrote: post #2

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). If you're trying to determine the hardness of your machines against known vulns there are two free (oss?) programs I'd recommend: Nessus and Snort. That may buy you time until yo…

> there are two free (oss?) programs I'd recommend: Nessus and Snort

Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner!

To the OP: If you want to test your website for security flaws, you can do the following (in no particular order):

- Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007

- Request a free scan from Qualys: http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6...

- Download and run w3af: http://w3af.sourceforge.net/

- Buy Burp v1.2 (when it comes out, soon. it's only about $150) and run Burp Scanner: http://portswigger.net/suite/

- Download Acunetix for a free XSS scanner: http://www.acunetix.com/cross-site-scripting/Copy-scanner.ht...

- Download SQLiX for a free SQL injection scanner: http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project

- ratproxy is a largely passive web application security audit tool: http://code.google.com/p/ratproxy/ and http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/

- Test it by hand yourself:

OWASP Testing Guide: http://www.owasp.org/index.php/Category:OWASP_Testing_Projec...

OWASP Guide to Building Secure Web Applications: http://www.owasp.org/index.php/Category:OWASP_Guide_Project

OWASP AppSec FAQ: http://www.owasp.org/index.php/OWASP_AppSec_FAQ

> Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming).

Dude, wrong again. The OP probably doesn't have an overly complicated website given that its just him and his buddy coding for a startup. An expert will likely estimate the amount of time it takes to test his website in a matter of [single-digit] hours. Also, webapp testing is the least expensive type of security testing there is.

Re: Ask YC: "Hacker-testing" service?

#5

Post by ca98am79 » Thu, Dec 04, 2008, 1:02 AM UTC

dguido wrote: post #4

aaroneous wrote: post #2

Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a website "safe" and it involves looking at many different aspects from all sorts of different aspects (time consuming). If you're trying to determine the hardness of your machines against known vulns there are two free (oss?) programs I'd recommend: Nessus and Snort. That may buy you time until yo…

> there are two free (oss?) programs I'd recommend: Nessus and Snort Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner! To the OP: If you want to test your website for security flaws, you can do the following (in no particular order): - Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 -…

awesome - thanks very much for your help

Re: Ask YC: "Hacker-testing" service?

#6

Post by poshj » Thu, Dec 04, 2008, 4:25 AM UTC

I remember a few years ago, Yahoo Aussie hired penetration testing IT consultant to do the "test". As many have pointed out, it's expensive. I forgot the name of the company but you can google it for "penetration test". dguido said a few cheaper solutions too.