How can I test PHP site security for most common security flaws?

I need to make sure that PHP sites that I administrate, don't have any common PHP flaws, like SQL injection, wrongly configured permissions to files and folders 开发者_开发问答etc. By site I mean for example Joomla site with plugins and modules. Making this security check manually can be time consuming and automated test could be run on daily basis to just make sure nothing has changed.

So my question is that is there any good automated software for this or do I have to code one myself?

Using a fuzzer is a good idea. But, you could also try coding an automated system yourself, as this will boost your knowledge about php and security issues/loop holes in your php sites.

I would personally use Google's Skipfish and find out for yourself if there are problems, then build your own just for your needs and ease of use. Good luck!

This can be done with a fuzzer or a web vulnerability scanner.

I've been using netsparker http://www.mavitunasecurity.com/

Not exactly what you need but it can help a lot :)

You should do both. Review your code and look for possible SQL-Injections etc.

Google released a very nice tool named "Skipfish" that scans your application for common security holes / attack patterns.

To familiarize yourself with common web security flaws, you may also wish to explore Webgoat

I recommend using the open source project wapiti which will test for XSS, SQLi, LFI/RFI and many more. There is also the commercial product Sitewatch($), and the best is NTOSpider($$$$$).

You can use a static code analysis tool, e.g. RIPS for PHP, to analyze your complete source code for security flaws. Fuzzing your website from the outside may not cover all code paths and overlook issues.

I doubt there's anything -good (so, 100% reliable)- that's automated. But a nice topic to go through might be this one on SO, as it lists "historical security flaws".

Historical security flaws of popular PHP CMS's?

RFI, LFI, SQL Injection, too many to discuss, and probably too boring to read one by one. I suggest you use a fuzzer instead. There many free ones and here's a wiki article about it: http://en.wikipedia.org/wiki/Fuzz_testing

This is a new and good tool fot testing,it can be used, from web developers, penetration testers or even security researchers to test web applications with the view to find bugs, errors or vulnerabilities. It worths to give a try Commix