Penetration testing for PHP security vulnerabilities

Question

I am doing a undergrad research paper on "Identifying and Testing security vulnerabilities in websites". Initially I thought I would test manually as I had specified in my methodology that I would only test for few chosen vulnerabilities i.e. SQL injection, Cross site scripting, error reporting, session hijacking and input validations. But as I continued researching I found all articles and tutorials suggested software.

I have few websites that my mates administer so I want to conduct testing on their sites. I am checking for few vulnerabilities on half a dozen websites. Should I use penetration testing tools or just do dynamic penetration testing without software?

Solution

It all boils down to what you want; you may use Burp Suite which is a great manual pentesting tool with a nice community and resource online that allows you to perform pen tests efficiently.

You might want to try automatic web application scanners such as Acunetix Web Vulnerability Scanner which also comes with manual pentesting tools and automatic crawling and scanning of a site (which is great IMO). They also offer free 14 day trials which should be more than enough for your purpose.

I always believe pentesting should start off with automated software tools as mentioned above and reinforced with manual intervention to make sure you tested the application effectively.

There's no right or wrong way to do it, however the above method is what many opt for. You might also want to read the Hacker's Handbook by Dafydd Stuttard and Marcus Pinto. This gives a great overview on web applications, how to penetrate them and how to safeguard them.

You can make use of utility tools such as Nmap and OpenSSL to confirm or attempt to discover vulnerabilities within an application.

Comments

[Juxhin]

@Soobax - Not at all. My first attempt at "pentesting" was SQL Injection using Google Chrome alone. Whilst I don't wish to provide online resources (as they're located on the darker side of the web) you have to understand that there are certain legal implications accompanied with such activity and you should get explicit permission from the server owners prior to attempting to breach their system in any way. Vulnerabilities such as SQLi/BSQLi/XSS (All 3 major types) and so on are all reproducible via a browser however would take much more effort to perform correctly and effectively.

[Juxhin]

@Soobax - A general suggestion granted you're in the current position is to deliberately make part of the applications you wish to test vulnerable to specific attacks. If you would like me to extend my answer to give solid examples I may do so.

[Admin]

I have taken permission from the web admins. I just want to perform basic testing to make sure security measures are implemented properly in PHP. What would you suggest would be my best bet?

[Juxhin]

Do you have permission to add or modify certain parts of their web application to make them deliberately vulnerable?

[Admin]

Yes can you please expand on that.

[Juxhin]

@Soobax Will do so, just give me some time. Will notify you when my answer has been updated.

[Admin]

No I have to test weather security measures are implemented properly. May be I can use 'acunetix' to perform detailed testing and extract the datas that I require.

[Juxhin]

@Soobax If you need to test that the application IS safe then you would have to adopt a different approach to proving it. The main key is how the web application handles user input (encoding/salts and so on). If this is the case then there are a millions articles online to read from that will definitely help you. However I would start from the OWASP top 10 vulnerabilities, say SQL Injection. See how the web application handles maliciously crafted SQL queries in the URL as a start.

[Juxhin]

@Soobax - If you have any more queries feel free to drop me an email if you like (it's in my profile description) instead of keeping it here. If you think the current answer answered your original question you may go ahead and mark it as accepted in order to close this question off.