Checkzx

Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:

#1
Joomla QPersonel Exploit
http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py

#2
Automated Joomla SQL Injection Exploiterhttp://www.xenuser.org/exploits/joomla_sqli_sploiter.py

#3
Joomla BF Quiz Exploithttp://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py

#4
Column Fuzzerhttp://xenuser.org/tools/column_finder.py

#5
Simple SQL Injection Vulnerability Scannerhttp://www.xenuser.org/tools/sqli_scanner.py

#6
Simple Log File Analyzerhttp://www.xenuser.org/tools/scan_log.py

#7
Simple Local File Inclusion Exploiterhttp://www.xenuser.org/tools/lfi_sploiter.py

These tools can help you to exploit vulnerabilities within Joomla or some extensions.

NOTE: Read the help (included in those tools) for details.

Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:

#1
Joomla QPersonel Exploit
http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py

#2
Automated Joomla SQL Injection Exploiterhttp://www.xenuser.org/exploits/joomla_sqli_sploiter.py

#3
Joomla BF Quiz Exploithttp://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py

#4
Column Fuzzerhttp://xenuser.org/tools/column_finder.py

#5
Simple SQL Injection Vulnerability Scannerhttp://www.xenuser.org/tools/sqli_scanner.py

#6
Simple Log File Analyzerhttp://www.xenuser.org/tools/scan_log.py

#7
Simple Local File Inclusion Exploiterhttp://www.xenuser.org/tools/lfi_sploiter.py

These tools can help you to exploit vulnerabilities within Joomla or some extensions.

NOTE: Read the help (included in those tools) for details.

Breach Extends Beyond the Victimized Company

September 22, 2011 - Eric Chabrow
The breach earlier this month of certificate authority DigiNotar could prove to be the worst security event ever to happen on the Internet because it threatens, at its core, a fundamental principle of Internet transactions - economic and social - trust.
Hackers broke into DigiNotar computers and stole the private key used by the Dutch company to assure the trustworthiness of the digital certificates it issued to website operators to guarantee users that the site visited is the one they intended to access. Employing the stolen private key, the hackers issued counterfeit certificates aimed at fooling visitors into believing some of the websitse they're accessing are the ones they intended to visit, and not the sham sites they've arrived at.

Functioning in our society, whether in the real or digital world, requires trust. 

Believed to be backers of the Iranian government, the hackers used the counterfeit certificates on Gmail, allowing them to direct users to a false site, in which they could spy on the messages dissidents sent, identifying them and those who they sent their e-mails. According to preliminary audit conducted by the IT security firm Fox-IT, more than 500 counterfeit DigiNotar certificates were issued to a wide range of organizations including the CIA; British and Israeli intelligence services; Internet companies Google, Microsoft and Mozilla; the social networks Facebook and Twitter; blog host Wordpress and credit-reporting agency Equifax.
The problem is that there is no way for visitors to verify the validity of the certificates. Check the URL, and one sees the https (https://gmail.com, for instance) in the URL that authenticates a trusted site. Click on a browser icon such as a locked padlock, and the window that pops up confirms the certificate was issued by a legitimate certification authority, even if it's a fake one.
Of course, if the browser company knows of the issuance of counterfeit digital certificates under the brand of a legitimate company, it can remove that company's digital certificates from the list of verified certificates, as many did with DigiNotar. But most DigiNotar certificates are legitimate, and if they're not on the list of verified certificate authorities on Chrome, Internet Explore, Firefox and other browsers, legitimate certificates have the same value as the counterfeit ones.
For DigiNotar, the breach has led to its demise; a Dutch court is liquidating the company under that nation's bankruptcy's law (see DigiNotar Declares Bankruptcy). Yet, DigiNotar could prove to be but one small victim of this breach, a footnote, perhaps. That's because functioning in our society, whether in the real or digital world, requires trust. The fundamental precepts of IT security are availability, confidentiality and integrity. Add them together, they equate trust. The DigiNotar breach places in jeopardy those fundamental precepts of IT security. And that puts all of us in jeopardy.

Breach Extends Beyond the Victimized Company

September 22, 2011 - Eric Chabrow
The breach earlier this month of certificate authority DigiNotar could prove to be the worst security event ever to happen on the Internet because it threatens, at its core, a fundamental principle of Internet transactions - economic and social - trust.
Hackers broke into DigiNotar computers and stole the private key used by the Dutch company to assure the trustworthiness of the digital certificates it issued to website operators to guarantee users that the site visited is the one they intended to access. Employing the stolen private key, the hackers issued counterfeit certificates aimed at fooling visitors into believing some of the websitse they're accessing are the ones they intended to visit, and not the sham sites they've arrived at.

Functioning in our society, whether in the real or digital world, requires trust. 

Believed to be backers of the Iranian government, the hackers used the counterfeit certificates on Gmail, allowing them to direct users to a false site, in which they could spy on the messages dissidents sent, identifying them and those who they sent their e-mails. According to preliminary audit conducted by the IT security firm Fox-IT, more than 500 counterfeit DigiNotar certificates were issued to a wide range of organizations including the CIA; British and Israeli intelligence services; Internet companies Google, Microsoft and Mozilla; the social networks Facebook and Twitter; blog host Wordpress and credit-reporting agency Equifax.
The problem is that there is no way for visitors to verify the validity of the certificates. Check the URL, and one sees the https (https://gmail.com, for instance) in the URL that authenticates a trusted site. Click on a browser icon such as a locked padlock, and the window that pops up confirms the certificate was issued by a legitimate certification authority, even if it's a fake one.
Of course, if the browser company knows of the issuance of counterfeit digital certificates under the brand of a legitimate company, it can remove that company's digital certificates from the list of verified certificates, as many did with DigiNotar. But most DigiNotar certificates are legitimate, and if they're not on the list of verified certificate authorities on Chrome, Internet Explore, Firefox and other browsers, legitimate certificates have the same value as the counterfeit ones.
For DigiNotar, the breach has led to its demise; a Dutch court is liquidating the company under that nation's bankruptcy's law (see DigiNotar Declares Bankruptcy). Yet, DigiNotar could prove to be but one small victim of this breach, a footnote, perhaps. That's because functioning in our society, whether in the real or digital world, requires trust. The fundamental precepts of IT security are availability, confidentiality and integrity. Add them together, they equate trust. The DigiNotar breach places in jeopardy those fundamental precepts of IT security. And that puts all of us in jeopardy.

For any attack to be successful, there should be a vulnerability which exists in the system.  Generally the vulnerabilities that exist in the software such as Operating System and Applications can be removed by implementing proper patch management solutions. But there exists an inherent vulnerability in all the systems which is called “Limitations” and that is the vulnerability that is being targeted by DoS or DDoS attacks.
To better understand that let us take an example of a fully patched web server hosting an e-commerce application, and availability of that application stands at the core of business for it to succeed.  Now since the server that hosts the applications is most critical business asset it has been properly patched and any operating system or application assumingly does not have any vulnerabilities. But as any other system the server has following limitations.
• Bandwidth
• Memory
• Processing Power
If any or all of these resources are consumed to the fullest, the end user access to e-commerce application service would get affected, thus creating a denial of service affect.
An attack that would make a service go unavailable is called DoS attack. Apart from exploiting vulnerabilities as discussed above, the DoS attack can also be performed by exploiting resources limitations.  Some of the attacks that are possible on any computer system are given below:
• Syn Flood
• UDP Flood
• Malformed Packets
• TCP RST Attack
• ICMP Flood
Since the attacker also uses a very similar computer system as that of Target, the attacker also suffers the same problem. That is to make the Target’s CPU go high, the attacker’s computer will also have to work hard enough thus making its own CPU go high. To over come these issues, attackers came with a new method where a small amount of attack can be initiated from large number of computer systems towards same target thus creating a DoS affect for target without creating one for self, and that method of attack is called Distributed Denial of Service Attack or in short DDoS attack.

For any attack to be successful, there should be a vulnerability which exists in the system.  Generally the vulnerabilities that exist in the software such as Operating System and Applications can be removed by implementing proper patch management solutions. But there exists an inherent vulnerability in all the systems which is called “Limitations” and that is the vulnerability that is being targeted by DoS or DDoS attacks.
To better understand that let us take an example of a fully patched web server hosting an e-commerce application, and availability of that application stands at the core of business for it to succeed.  Now since the server that hosts the applications is most critical business asset it has been properly patched and any operating system or application assumingly does not have any vulnerabilities. But as any other system the server has following limitations.
• Bandwidth
• Memory
• Processing Power
If any or all of these resources are consumed to the fullest, the end user access to e-commerce application service would get affected, thus creating a denial of service affect.
An attack that would make a service go unavailable is called DoS attack. Apart from exploiting vulnerabilities as discussed above, the DoS attack can also be performed by exploiting resources limitations.  Some of the attacks that are possible on any computer system are given below:
• Syn Flood
• UDP Flood
• Malformed Packets
• TCP RST Attack
• ICMP Flood
Since the attacker also uses a very similar computer system as that of Target, the attacker also suffers the same problem. That is to make the Target’s CPU go high, the attacker’s computer will also have to work hard enough thus making its own CPU go high. To over come these issues, attackers came with a new method where a small amount of attack can be initiated from large number of computer systems towards same target thus creating a DoS affect for target without creating one for self, and that method of attack is called Distributed Denial of Service Attack or in short DDoS attack.