Web security : tool that u can make use to test your website

It important for a web-developer to know kind of attack malicious people make use to do damage to your web site.

You can easily visualize how these attack is being used for some of the world biggest data breached
Check the information beaches around the world http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/


some of the common one are

1. SQL injection.  here I will discuss error based sql injection.In these attacker try to modify the serach query in the url and then try to get the error and next he will modify the query to get output they you does not want to desirably want to share on the web page.

The easier way to make user of automated tool "Havij". Plz explore it to validate to test your website.
Make sure validate the data getting as external input eg if u are expecting number .. then it should be number in thr post and get request.
The other best way to get stay away from SQL injection to make use of binding variable  (parameterize queries) in query that you are making use having the input from the outside.
The last one is allow application to have access access to certain table with "principle of least permission". Eg should ur application db account , can run database admin command".
Last one but important is web application firewall and cryptographic storage.



2.  Insufficient Transport Layer Security : it  mean here that are you making lack of making secure layer (eg http or https) while communicating to web server on internet.Most people get hacked when they using open wifi network. Here , attacker may monitor the information in and out flowing through the router. Some attacker even modify the DNS server setting for common ip request to their own hosted website with replicated page.
Some times attacker inject the key loger js script into the page. So how to prevent such attack.
Make sure that you web application login page open in https mode along with https post form is used.So apply TLS to encrypt by default (U need to pay some money to get the certificate) if you are expanding your application especially for the login page authentication.

Also make use of encrypted authentication cookies in your application and firewall is the last defense.
Also check out out the blog how to setup SSL certificate.
https://ksylvest.com/posts/2014-05-06/setup-free-ish-ssl-tls-on-heroku-for-ruby-on-rails-or-any-other-framework



3. Insecure Password Storage
I hope very developer  is aware of rainbow table.Here the attacker has pre-computed hash table that he make use of guess the password. Easiest way to prevent , to make use of bcrypt algorithm (avoid md5) and save password and random salt used , save  in two separate column. You can add additional layer of security by encrypting the output from bcrypt again using md5.
 
eg
byscript alogorithm -> random salt + password -> md5 -> save salt column and password column
I future I may be sharing , how to implement the above in node js

4. Cross Site Scripting (XSS)

5. Weak Account Management