[RESOLVED] Security testing

[Ausx]

Hi guys,
I've been doing an online proofing system for the company I work for. It's not exactly complex but if someone with some PHP experience could test it out for security or give some guidlines on good ways to test it I'd appreicate it. The people who are likely to be using it will probably not have too much knowledge of the launguage so it doesn't need to be over-the-top secure, just enough.

Basically, if you can do anything that obviously shouldn't happen to the database or see any of the other users data, hack into either the admin area or other accounts etc, please tell me with an explanation of how it was done.

Thanks in advance

See blow posts

Also, my the way, ignore the infinished look, some of the unimportent pages / images aren't done yet.

[MarkR]

I recommend that nobody takes you up on your offer. I expect your intentions are good, but you must realise that by attempting penetration testing without the proper legal documents in place, users of this forum could land themselves in trouble.

Because we've no guarantee that that is in fact your own web site, never mind having explicit permission to attack it, we cannot legally do so.

If you want someone to pen-test your application, whether for free or paid, I recommend that you have a contract in place which states exactly what they're allowed to do, when, and something which lets them verify that you do indeed have the proper authority to authorise such an action.

Mark

[Ausx]

Ah, good point I never thought of it that way. Okay thanks for the advise.