Friday, April 6, 2012

Check your website security using ASafaWeb

Troy Hunt, the creator of the great ebook about the OWASP Top 10 specifically targeted at .NET developers has built a great tool to check your website security: ASafaWeb.

What’s ASafaWeb?
“ASafaWeb is the Automated Security Analyser for ASP.NET Websites. The purpose of ASafaWeb is to make scanning for common configuration vulnerabilities in live ASP.NET websites dead easy. To that effect, you don't need anything more than a URL to get started and ASafaWeb will head off and report on anything it can find which is remotely detectable.”
Whilst this is an unequivocally a basic tool, it will still find configuration flaws in many web sites. The sort of flaws it finds are things like custom errors being off, YSODs with stack traces being returned, tracing still on, debug mode enabled and many, many more.
How does it work?
image
  • Enter the url of your application and click Scan. Can it be any easier? (I tried it with my employer's website Glimlach).
image
  • Once the scan has completed, you get a nice summary report and details about all the scanned parts, problems and possible ways to fix them. Nice!
image

No comments: