Web Security - Tool List - Free Knowledge Transfer

Hi guys

In this topic i wanna share some security tools, which help you to make your web projects more secure.
If you also know good security solutions, please post here

I work with these tools every day and have made good experiences with them. They cost nothing or very little and are especially suitable for the security of web projects.

WEB SECURITY STANDARD CHECK
Hardenize (Free)
Qualys SSL Labs (Free)
Mozilla Observatory (Free)

SECURITY SOURCE CODE ANALYSIS
SonarQube (Open Source & Cloud Subscription starts by 120$ p.Y)

WEB SECURITY SITE CHECK & MONITORING
Siwecos (Free and really powerfull!)

SECURITY ASSESMENT AND VULNERABILITY MANAGEMENT
Hacker Target (Cloud subscription starts by 10$ p.M)

MALWARE SCANNER
Sucuri SiteCheck (Free)

WEB APPLICATION FIREWALL
Sucuri (DNS WAF - subscription starts by 9.99$ p.M)
ASTRA Security (PHP WAF - subscription starts by 19$ p.M)
Imunify360 (Webserver WAF (you can use a Webhoster like Stablepoint, which use Imunify) - subscription starts by 12$ per Server p.M)

For topics like web hardening, you should read the gudlines of OWASP.

I hope my list helps you to make your web projects more secure

Cheers and good luck!

Thank you for sharing this list.

It's good to know what tools to use for security and I know that a lot of the newer members of the forum will find this useful.

Do you know of anything WordPress Specific for security?

Thanks! Have saved this for future reference.

Also, like @RyanHSEO mentioned, can also you share something WordPress specific?

Cheers!
Armur

Hi @RyanHSEO

If you work with Wordpress (or generally with a CMS), you should always keep your CMS and plugins up-to-date.

The update order for Wordpress is (If you do not follow these steps, you can get into trouble):
Step 1: Backup
Step 2: Plugins update
Step 3: Themes update
Step 4: WordPress update
Step 5: Check your Website

The tool SIWECOS is free and supported from the Germany Governement for the industry.
If you create a register account, your website will be automatically scanned for vulnerabilities on a daily basis and you will be notified via email. Your Wordpress version and plugins will also be checked.
You should test it ;-)

As next step, your website should have implemented the minimal security standard of OWASP Top10
https://observatory.mozilla.org/
https://owasp.org/www-project-top-ten/

Wordpress Hardening:
Cybercriminals use technics like Google Hacking or SEO Tools like A-Parser to identify your indexed website and admin login.
As administrator of a CMS you have several options:
- Option 1: you can change in your source code the name and path of your admin login file (but this can make some issues with the CMS updates and plugins)
- Option 2: you block with a WAF some critical Countries, Index Bots or allowe only your IP to the Admin Login
- Option 3: you limit the login attempts and use solutions like reCAPTCHA, 2FA (Attention! in the case of a brute force attack, it can happen that the admin account is locked for a while.)
Generally: you should not use Loginnames like Admin and easy passwords, because cybercriminals use a lot of automated bots to check your login

Example of A-Parser to identify websites with wp-login.php, Wordpress Websites, Versions...



GOOGLE HACKING GUIDE
https://www.blackhat.com/presentations/bh-europe-05/BH_EU_05-Long.pdf

WEB APPLICATION FIREWALL
A WAF can help you to block some bad bots or cyber attacks, but the problem with WAFs is, they can make also bad SEO ranking for your website, if they block web crawlers of search engines like Google and Co. So you need to check your firewall logs, activities and auto block lists! but in the most cases, the WAF companies have a very good white and blacklist of search engine web crawlers.

If you install a WAF, you have to think about the layers and requirements (Security vs. Performance).
If you have a international Website with a lot of traffic and users from different countries, it can make sense to install a DNS WAF with a CDN and DNS AnyCast solution like CloudFlare or Sucuri.
Because then you have not a performance issue with your traffic, but the issue with DNS Firewalls is WAF bypassing...
https://owasp.org/www-pdf-archive/O..._how_to_defeat_the_blue_team_-_2015.10.29.pdf

If you have a smaller website, you can protect your website with a PHP Firewall.
I have good experiences with ASTRA Security (starts with 19$ p.M per Website) or Shield Security Pro for Word Press (starts with 1$ p.M per Website).
But with a PHP Firewall, your website can be slower and in the most cases you have to edit the HTML/PHP file with the path of your PHP WAF.

You can use also a Webhoster, which protect your websites with Imunify360. With this solution you have Websever Security and WAF.
I have good experience with the Webhoster Stablepoint in this case.

PASWORDS AND 2FA
Cybercriminals automate logins, so its really important that you use in your life different passwords.
You can check all password leaks with https://haveibeenpwned.com/
And you should activate also Multi-factor authentication (2FA) if its possible with a SMS or Authenticator.
I have very good experience with Dashlane (https://www.dashlane.com/) as Password Manager. So i generate for all my logins and Websites randowm passwords and safe it in this password manager and activate 2FA.

Why is this important?
Cybercriminals check also your Domain URL and subdomains with free tools like:
https://securitytrails.com/list/
And they can identify your Webhoster Login, Webmail URL... very easy.
So if you use the same password in all your logins and your password is leaked from a hacked plattform, they can use your hacked password.

In this case, ity also very important that you use for all your Domains a Whois Privacy, because otherwise the cybercriminals can check your E-Mail Adress in the whois database.
I have good experience with the domain privacy of https://www.infomaniak.com/en/domains/domain-privacy

Excuse me for my bad English. I hope you understand what I mean...Does this information help for the beginning?

For WordPress, WordFence plugin is a must! I use the free version which does the job well.

Would like to also mention a tool called WPScan.
Most web app hackers start with this.
It'll point out any known vulnerable plugins and other things you might have on your WordPress site.

I can highly recommend SIWECOS ..I use it for a while for protecting sites

since few months i protect all my websites with https://cleantalk.org/ and i have very good experience with this solution. they have 2 plugins. One plugin for antispan and the other plugin as firewall for the protection of cyberattacks. The IP black list block all bad bots so i have no any spam comments and mails and can monitor all projects in the cloud GUI.