How to attack my own website?

Question

I am currently working on security for a website (JSP) that contains 2 pages: a login and a data page. Once a user logs in, he is able to SELECT data from a specific table with read only access.

After browsing security risks online, I have wrote down a general list of what I might have to defend against

1. Injections
2. XSS
3. Auth / Session hijacking
4. CSRF
5. Direct Object Ref

Currently, I am reading about how to defend these attacks and what I should include in my code. However, I won't really know if my code actually works unless I test these attacks out for myself (and even then, there still might be other attacks that work). Right now, I just want some security, and thus I need to know how to produce these attacks so I can try them on my site.

Injections were simple as all I had to do what type '1'='1 in my code to reveal that it was flawed. Then I used prepared statements and SQL injections didn't work anymore.

How can I produce the rest of these attacks to see if my security atleast works against basic attacks?

(Also, is there perhaps some safe site or tool I can use to test out my vulnerabilities?)

Answer 1

I assume from your list that you're looking at the Open Web Application Security Project Top Ten. Good!

Really, the best advice I can give is to read through the OWASP site. A good first step would be to go through the individual links on that page (e.g. Broken Authentication and Session Management) and check the "Am I vulnerable?" section. Here are some further hints:

XSS

The XSS Cheat Sheet can be pretty helpful here. More examples than you can shake a stick at, ready to paste into your site.

CSRF

OWASP's wiki has a CSRF Testing Guide full of great links and suggestions.

Auth/Session hijacking

Well, are you using HTTPS? See this answer for more.

More resources

If you want to Go Deeper and do some real testing, here are some things you can do:

• Read the Web Application Hacker's Handbook.
• Try out some of the examples on http://hackthissite.org and the Google Gruyere project and see if you can break into them.
• Download Kali Linux and learn to use some of the tools that come with it.
• Go to a security conference or minicon near you and connect with other infosec people. Maybe I'll see you there :)