Waraxe IT Security Portal

schnibble · Regular user

Need some advise so I am going straight to the problem.

I did one security hardening of PHP/MySQL site, after it was attacked. There were some obvious vulnerabilities as 'globals on' and unencrypted passwords in database. I fixed those, add few features, enhanced it a bit.

So, after that, one other owner of similar site, which uses same script, but heavily modified asked me if I would check his script. That owner has much more traffic and bigger income from the site.

After short examination, I found out pretty much the same things. So I plan to offer them at least encrypting the database, and few other things.

Now, my question is how much should I ask for?

I plan to offer them in parts, for example:
- administrator and users table encryption and according PHP modifications: $xxx.xx
- removal of risky/unnecessary/not protected data: $xxx.xx
and so on...

What else can I include? And how much could I ask for it?

In addition, if someone has some experience with those things, maybe he could tell me how to automate process of vulnerability searching.