关于代码扫描/渗透测试工具的建议
据我所知，这些产品分为两类 - 扫描服务（例如 McAfee、Comodo 等）和工具（例如 Burp Proxy、HP 的 WebInspect、CodeScan 等）。
在理想的情况下，我会使用主动扫描的东西每天（或者如果它是独立工具，则根据需要）某个 URL（目标是 LAMP 堆栈），但我对独立工具的覆盖范围和更新频率有点警惕。 （McAfee 等“远程”扫描仪可能会根据需要进行更新。）
我还遇到了一些独立工具的问题（不幸的是不记得是哪一个），这些工具设法在我们的 URL 重写系统中迷失方向（有一个分面的工具）。进行中的搜索，因此您可以想象 URL 前面的内容会相当深入）。
因此，我只是想知道人们对现有产品的体验如何，以及独立工具是否可以与扫描服务相媲美。
（顺便说一句，我知道渗透测试工具 - 我只是想知道情况是否已经改变自那以后）
As far as I can see the offerings fall into two categories – scanning services such as McAfee, Comodo, etc. and tools such as Burp Proxy, HP’s WebInspect,CodeScan, etc.
In an ideal world, I’d use something that actively scanned a certain URL (the target being a LAMP stack) on a daily basis (or as required if it’s a standalone tool), but I’m a bit wary of standalone tools in terms of their coverage and frequency of updating. (The ‘remote’ scanners such as McAfee are presumably updated as required.)
I’ve also had issues with some standalone tools (can’t remember which one unfortunately) that managed to get themselves lost within our URL rewriting system (there’s a facetted search in play, so you can imagine things get fairly deep on the URL front).
As such, I’m just wondering what experiences people have had with the offerings out there and whether the standalone tools stack up against the scanning services.
(Incidentally, I'm aware of Penetration testing tools - I'm just wondering if the situation has changed since then)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我已经完成了渗透测试和利用开发。我可以从第一手经验告诉你，黑客行为不仅仅是发射一些工具。有时工具可以让生活变得更轻松，但如果您不知道自己在做什么，那么工具就无济于事。
如果您想知道您的系统是安全的，那么您需要更熟练的黑客才能闯入。PCI-DSS 是信用卡处理所需的认证，要求您定期进行渗透测试在您的服务器上。如果您想拥有一个非常安全的服务器，则应该采取定期进行渗透测试的方法。
Web 应用程序防火墙 (WAF) 是 Web 服务器的一个非常好的安全措施。 PCI-DSS 也要求使用 WAF。 Mod_security 是免费开源 WAF。 Mod_Security 可用于防止数百种不同类型的攻击。 WAF 对于渗透测试人员或黑客来说可能是一场噩梦。
I have done penetration testing and exploit development. I can tell you from first hand experience that hacking isn't just firing off some tool. Sometimes tools can make life easier, but if you don't know what you are doing then a tool isn't going to help.
If you want to KNOW that your system is secure then you need to higher a skilled hacker to break in. The PCI-DSS is a certification required for credit card processing which mandates that you have regular penetration testing conducted on your server. Conducting regular penetration testing is something that you should adopt if you want to have a very secure server.
A very good security measure for web servers is a Web Application Firewall (WAF). WAFs are also required by the PCI-DSS. Mod_security is free and open source WAF. Mod_Security can be used to prevent hundreds of different types of attacks. A WAF can be a nightmare for a penetration tester or would be hacker.