How do you test your web applications?
tptacek: Since I do this professionally, I have a lot to say about testing web apps, but I'm going to keep my recommendation short and precise.Go here:  http://portswigger.net/suite/

Drop the $200 or so for a copy of Burp Suite Pro.Burp is the industry standard tool for testing web apps; probably more than half of all web app penetration testers use it. It's like Firefox Tamper Data on steroids; it gets between you and your request, breaks out all the parameters for you, and gives you tools to manipulate and replay the requests.You in particular want to understand the Burp Intruder, which is Burp's fuzzer. The fuzzer takes a request, tries to figure out where all the parameters are (you can help it with that), and then feeds malicious inputs through them and records the responses.You want to fuzz every page in your application at every code drop. We've seen entry level QA people trained to do this, so delegate the task if you're not sure you can make yourself do it reliably. You want to collect every error response, and you want to grab your application logs and look for every exception or abnormal event. You want to know how the responses are different from the last run each time you ship a new version of the app.Burp is so extremely effective that I'm amazed every web dev team doesn't already have a copy. I think it's because it's billed as a "security" tool. But it's obviously more than that.Webdevs have a lot to say about unit testing and cloud testing and integration testing and test-first development. What I can tell you is that I've seen no correlation between test methodology and pentest outcome. The TDD teams fall just as fast as the seat-of-the-pants teams. I want to strongly recommend that you don't waste time strategizing on how you'll test or validate architecture or whatever. Burp is a no-BS tool. Get it, run it, and you will find bad things. Work out your effective bill rate and the amount of time it takes you to adopt or extend a test suite, and it's the cheapest quality enhancer that's probably available to you. Do whatever you want on the testing side, but do Burp first.