How you secure your website.
 

Hi GFY!

Those of you on here who have websites: how do you make sure your site is secure?

Those of you on here who have custom coders: How do you make sure the code they write doesn't open you up to hackers? How do you make sure they use best practices?

Those of you on here who have software products: how do you secure your product? What practices do you use? How do you defend against things like SQL injection and arbitrary code execution?

You trust your programmer knows what they're doing? That's what I do.

I would trust my programmer with pretty much everything.

That makes a lot of sense if you've had the same coder for a long time.

What if you're hiring a new coder?

Does anyone on GFY do penetration testing? Do you see it as a service that would be useful on here?

There's a couple guys who do pen testing on here. I'm not sure there's much of a market for it in adult. The big boys(who are usually the least secure from my experience) think they're way more secure than they are, so won't hire outsiders usually. Not many people are willing to pay the premium to make sure they're truly secure in adult, but there are a few who have / do.

Most people here have small sites. The new thing is bug bounties. Sign up for HackerOne and look at the top guys. Follow them on twitter. I have a hackerone profile, But I am slow and old, So I have found no bugs yet.

One guy gave me $40 paypal and another guy offered me a costume when I found a reflective XSS bugs in their site. You can do that on XSSposed.org. But most of those easy bugs are being found and reported. More people are getting keen on sanitizing their user input.

Just a few days ago a guy found an XSS bug in yahoo mail. They gave him $10,000.
I think he was on Bugcrowd.

Just got through playing with Burp Suite today. Figuring out how it works. Fun stuff. But I probably shouldn't have run the spider function. I may get in trouble for that. Burp acts a proxy between your browser and a site. You can intercept input and change parameters before passing on the data to the site.

I use wordpress on shared hosting with some security plugins.
I know it's not ideal..

I would cry.

giant bitch named rose

I know someone whose brother does penetration testing for larger companies not from GFY :1orglaugh Pete's brother is certified to do PCI audits. People that are qualified to do audits and web server penetration testing are too expensive for 97+% of the audience I see here.

put your script. adjust to keep the logs on another server.
doing permanent backup on another server.
read logs and constantly monitors the server.
after ferst cracked - look at the logs as and the fixes in it backups
load fixed backups on new server
repeat until the hacks do not stop
You can leave a note for the hacker reward for the found vulnerabilities - This will reduce the likelihood of damage to you.

Don't advertise your program in black hat and botnet forums.