威胁建模主要是为了识别出当前系统主要的风险点，想象以下一个攻击者入侵系统主要是为了什么，
一般包括：
Assets
Data
Functionality
Entities/processes
Interfaces and entry points
Control and data flows
Trust zones and boundaries
Threat agents
Security controls
一般会使用Viso画组件图，标明数据流和资产，识别风险点
此外还会用脑图工具画Attack Trees，列出每个风险点，以及达成风险的条件和对应应该采用的措施
举例：
Summary of Threats by Risk
Critical
T#1: Exhaust resources on the Docker host from the workspace container
T#2: Execute arbitrary code on the Docker host
…
High
T#5: Gain unauthorized access to sensitive CloudIDE functionality and data
T#6: Gain unauthorized access to source code
…
Medium
T#10: Run malicious docker images
T#11: Abuse insufficient logging and log monitoring
应用程序侦查主要是理解应用程序的攻击面，包括
URLs/pages
Parameters
Headers
Cookies
Etc…
可以使用Burp Spider，Skipfish等工具来侦查。顾问尤其推荐BurpSuite，它里面包括了很多小工具（
部分功能商业版
网络侦查是为了理解系统网络的限制，包括
From external network to internal network
From internal network to external network
From network segments to other network segments
经常用的工具有Nmap，Zenmap，Vulnerability scanners
比如Demo nmap:
nmap -v -P0 -sSV -O 100.100.17.0/24 -oN cloudide-subnet.txt 可以输出这个网段所有的主机和IP
1.Injection
2.Broken Authentication and Session Management
3.Cross-Site Scripting (XSS)
4.Insecure Direct Object References
5.Security Misconfiguration
6.Sensitive Data Exposure
7.Missing Function Level Access Control
8.Cross-Site Request Forgery (CSRF)
9.Using Components with Known Vulnerabilities
10.Unvalidated Redirects and Forwards
Metasploit framework
John The Ripper
Medusa
Sqlmap
Ettercap
Arpspoof
Kali Linux
Contains all of the above
如果想做安全测试，建议直接使用Kali Linux的系统，因为这个系统里默认包含了上面大部分工具
Web Vulnerability Scanners
Fully automated
Great for catching low hanging fruits
No understanding of application business model
Can generate large amounts of false positives
Triaging issues can be time consuming
Basic workflow:
Point the tool to application entry points
Select tests to perform
Launch scan
Triage findings
Generate report
商业的:
Acunetix
Burp Scanner
IBM AppScan
QualysGuard
HP WebInspect