Pentesters?
Hi folks, I'm working on a side project that I'm hoping will eventually become a sass within the water industry. From the start, I want to make the api/site as secure as possible. I know a bit about sql Injection, CQRS, CORS, XCSS, sanitising, fuzzing, encryption etc. from a development standpoint, but don't want to have to learn to be a web app security professional or invest money + time in all the tools they use. What the best approach initially and ongoing? Any recommendations?
Thanks in advance
Start with the OWASP Top 10 and start getting into the habit of scrutinizing your code while keeping those common vulnerability categories in mind. If you want to get thorough you could go through the Web Security Testing Guide
If you want a DIY vulnerability scan, you can grab OWASP Zap (free) and run it against your app, just keep in mind there may be quite a few false positives.
Hi, see about, token field validations
Speak in php
Token field == token cookie == token session
best way to deal with SQL Injection, XSS and include file