Security testing Tool for SPO in Office 365

Question

We have created a site in SharePoint online for a customer. On high level following are the areas of customization: - Custom master pages - Bootstrap - Content Editor webparts with JS source files. - CQWP, XSLT customization, JSLink - Search, display templates - Designer workflows. - List views and list forms. - Query string parameters in navigation. No sandbox solution, no Apps.

Customer has requested us to do security vulnerability test for the application. We had used IBM AppScan in one of the earlier application for SharePoint 2013 OnPrem deployment, but it has reported issues in base product too. Request you to suggest a tool you might have used in earlier SharePoint 2013 Online projects. Also comment about licensing.

Answer 1

You can start with Fiddler and SoapUI. I have used fiddler to test internet SharePoint sites where admins would have enabled lists for anonymous users, but thought users won't be able to reach them, and exposed that via web forms and captcha, but I could get the url to the list and add 100 items during the tests in 15 seconds using Fiddler (A hacker would write a script to do this and add millions of items, imagine if you have email notifications turned on..)

The same principles that go with testing security for any site, would go for SharePoint/SharePoint Online. If you need more info, I encourage you to watch these 2 videos:

You think you can hack SharePoint?

SharePoint Hacking