Ask HN: website security app (sanity check)

#1

Post by bandhunt » Thu, Oct 28, 2010, 6:49 PM UTC

Hey HNers, I've received less than excited responses from friends about what I'm building and need a sanity check from you guys.

I've been working on some automated security testing software that would crawl and scan sites for open web exploites (sql inject, xss, xsrf etc..).

Initially I'd offer free scans to HNer sites and the bigger goal is to create a paid service.

  Would you use this service?
  Would you pay for it?
  Do you have your security covered (ie don't need a 3rd party audit)?
  Any tools that you currently use that are good enough for your needs?

Thanks guys!

Re: Ask HN: website security app (sanity check)

#2

Post by tsycho » Thu, Oct 28, 2010, 8:25 PM UTC

My site isn't up yet, but I would use this service, and be willing to pay for it as well.

If you are an expert in this domain, maybe you could have a cheap automated testing suite, and then offer a consulting service to help fix the security issues.

Re: Ask HN: website security app (sanity check)

#3

Post by m0nastic » Thu, Oct 28, 2010, 8:52 PM UTC

Just out of curiosity, how will you verify that your clients actually own the site they want scanned?

And what sort of contract will you have in place for outages caused by the scanning, liability limitations, etc?

I absolutely think you could flourish with a service like this, but there are some kinks you'll have to work out.

Re: Ask HN: website security app (sanity check)

#4

Post by aquark » Thu, Oct 28, 2010, 9:18 PM UTC

m0nastic wrote: post #3

Just out of curiosity, how will you verify that your clients actually own the site they want scanned? And what sort of contract will you have in place for outages caused by the scanning, liability limitations, etc? I absolutely think you could flourish with a service like this, but there are some kinks you'll have to work out.

A simple validation of ownership would be something like google uses for the google apps for domains: generate a unique id and ask them to create a file of that name on the domain. As a secondary check ask for something to be created in the dns records for the domain.

Re: Ask HN: website security app (sanity check)

#5

Post by aquark » Thu, Oct 28, 2010, 9:21 PM UTC

Is this looking just through a known list of exploits for popular packages/libraries, or is it doing something find holes in my application code?

I'd certainly be interested in the later, and even just hearing how you go about that.

Re: Ask HN: website security app (sanity check)

#6

Post by jumby » Thu, Oct 28, 2010, 10:13 PM UTC

isn't this what Nessus does?

also, i think there are lots of players in this area.

Re: Ask HN: website security app (sanity check)

#7

Post by gbrindisi » Thu, Oct 28, 2010, 11:53 PM UTC

Consider that a lot of web sec scanners exists and are free (like Skipfish).

Re: Ask HN: website security app (sanity check)

#8

Post by bandhunt » Fri, Oct 29, 2010, 4:34 AM UTC

jumby wrote: post #6

isn't this what Nessus does? also, i think there are lots of players in this area.

They don't go as in-depth at the application level.

Do you use any of other the other services?

Re: Ask HN: website security app (sanity check)

#9

Post by bandhunt » Fri, Oct 29, 2010, 4:34 AM UTC

aquark wrote: post #4

m0nastic wrote: post #3

Just out of curiosity, how will you verify that your clients actually own the site they want scanned? And what sort of contract will you have in place for outages caused by the scanning, liability limitations, etc? I absolutely think you could flourish with a service like this, but there are some kinks you'll have to work out.

A simple validation of ownership would be something like google uses for the google apps for domains: generate a unique id and ask them to create a file of that name on the domain. As a secondary check ask for something to be created in the dns records for the domain.

That's the plan. Thanks!

Re: Ask HN: website security app (sanity check)

#10

Post by bandhunt » Fri, Oct 29, 2010, 4:35 AM UTC

aquark wrote: post #5

Is this looking just through a known list of exploits for popular packages/libraries, or is it doing something find holes in my application code? I'd certainly be interested in the later, and even just hearing how you go about that.

Cool. More on the application code side.

Email me (see my profile) and I'll give you free scans when I launch if you'd like.