0

We have created a site in SharePoint online for a customer. On high level following are the areas of customization: - Custom master pages - Bootstrap - Content Editor webparts with JS source files. - CQWP, XSLT customization, JSLink - Search, display templates - Designer workflows. - List views and list forms. - Query string parameters in navigation. No sandbox solution, no Apps.

Customer has requested us to do security vulnerability test for the application. We had used IBM AppScan in one of the earlier application for SharePoint 2013 OnPrem deployment, but it has reported issues in base product too. Request you to suggest a tool you might have used in earlier SharePoint 2013 Online projects. Also comment about licensing.

1

You can start with Fiddler and SoapUI. I have used fiddler to test internet SharePoint sites where admins would have enabled lists for anonymous users, but thought users won't be able to reach them, and exposed that via web forms and captcha, but I could get the url to the list and add 100 items during the tests in 15 seconds using Fiddler (A hacker would write a script to do this and add millions of items, imagine if you have email notifications turned on..)

The same principles that go with testing security for any site, would go for SharePoint/SharePoint Online. If you need more info, I encourage you to watch these 2 videos:

You think you can hack SharePoint?

SharePoint Hacking

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.