Pen-Testing your Self-hosted sites?
reddit / selfhosted

----------------------------------------------------------------------
Ben4425 · 2023-09-29 01:25

I'm looking for a free online tool to pen-test my web site. Any
recommendations?

P.S. My google-fu apparently sucks because searching for free
penetration testing produces reams of useless hits...

​

----------------------------------------------------------------------
Murky-Sector · 2023-09-29 02:10

shields up

https://www.grc.com/

----------------------------------------------------------------------
NikStalwart · 2023-09-29 06:42

burp suite? Is that still a thing?

----------------------------------------------------------------------
light_weight_baby_ · 2023-09-29 08:35

Qualys guard has a free website vulnerability check... haven't used it
in a while..

https://www.ssllabs.com/ssltest/analyze.html

----------------------------------------------------------------------
maximus459 · 2023-09-29 10:18

Nessus

----------------------------------------------------------------------
_mnz · 2023-09-29 13:22

Greenbone

Also available via KALI I think

----------------------------------------------------------------------
zwamkat · 2023-09-29 16:23

This is merely a tool to test your SSL configuration on your web
server. It tests for validity of certs and whether you configured the
industry standard ciphers among other certificate related stuff. It
might be part of a penn-test but only a very small part.

----------------------------------------------------------------------
zwamkat · 2023-09-29 16:24

GRC is a tool to test for open ports. It does not tell you if you have
vulnerable configuration/software.

----------------------------------------------------------------------
sk1nT7 · 2023-10-01 21:01

Have you self-developed the website or is it some kind of CMS?

1. Check your HTTP headers with securityheaders.com
2. Check your SSL/TLS configuration with Qualys SSL scanner
3. Run a portscan on your hostname or IP address with e.g. nmap.
Ensure that you do not expose something unwanted.
4. May run Nessus or Greenbone vulnerability scanner on your website.
Likely does not find anything.
5. Use Burpsuite as intercepting proxy and test your site manually.
May use the scanning engine of Bupsuite, if available in the community
version.
6. If you run some kind of CMS like WordPress, Typo3 or Drupal, there
are specific test tools available. Wpscan, typo3scan and
droopescan/drupwn

As you have likely the source code; may use SAST and DAST scanners.