• OWASP web site (https://www.owasp.org/index.php/Main_Page)

The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide
charitable organization focused on improving the security of application
software. In their web site, you almost could find every piece of information
regarding security.

• Microsoft Security Development Lifecycle (http://www.microsoft.com/security/sdl/default.aspx)

A practical process we could follow to make our software more secure.

• Security Essentials (http://www.microsoft.com/en-us/security_essentials/default.aspx)

Microsoft Security Essentials provides real-time protection for your home or small business
PC that guards against viruses, spyware, and other malicious software.

Microsoft Security Essentials is a free* download from Microsoft that is simple to
install, easy to use, and is automatically updated to protect your PC with the
latest technology.

• Fiddler (http://www.fiddler2.com/fiddler2/)

Fiddler is a Web Debugging Proxy which logs all HTTP(s) traffic between your computer
and the Internet. Fiddler allows you to inspect all HTTP(s) traffic, set
breakpoints, and "fiddle" with incoming or outgoing data. Fiddler
includes a powerful event-based scripting subsystem, and can be extended using
any .NET language.

• IE 9 - F12 Developer tools (http://msdn.microsoft.com/en-us/library/gg589512(v=VS.85).aspx)

Windows Internet Explorer 9 provides a view of your rendered code, and F12 tools
provides a view of how those pages are interpreted on a code level by Internet
Explorer 9. F12 tools also help identify and report about elements on the page
such as links and image reports.

• Burp (http://portswigger.net/burp/download.html)

Burp Suite is an integrated platform for performing security testing of web applications. Its
various tools work seamlessly together to support the entire testing process,
from initial mapping and analysis of an application's attack surface, through
to finding and exploiting security vulnerabilities.

• DOMinator (http://blog.mindedsecurity.com/2011/05/dominator-project.html)

DOMinator is a Firefox based software for analysis and identification of DOM Based Cross Site
Scripting issues (DOMXss).

• Dom Snitch (http://googleonlinesecurity.blogspot.com/2011/06/introducing-dom-snitch-our-passive-in.html)

Dom Snitch is a Chrome based software for analysis and identification of DOM Based Cross Site
Scripting issues (DOMXss).

• WACA (http://www.microsoft.com/download/en/details.aspx?id=573)

Web Application Configuration Analyzer (WACA) analyzes server configuration for security best practices
related to General Windows, IIS, ASP.net and SQL server settings.

• CAT.net (http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19968)

CAT.net is a binary code analysis tool that
helps identify common variants of certain prevailing vulnerabilities that can
give rise to common attack vectors such as Cross-Site Scripting (XSS), SQL
Injection and XPath Injection

• !Exploitable Crash Analyzer (http://msecdbg.codeplex.com/)

!exploitable is a windows debugging
extension that provides automated crash analysis and security risk assessment.

• Threat Analysis & Modeling tool (http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14719)

Microsoft Threat Analysis & Modeling tool allows non-security subject matter experts to enter already known
information including business requirements and application architecture which is then used to produce a feature-rich threat model.

• Windows Sysinternals (http://technet.microsoft.com/en-us/sysinternals/bb545021.aspx )

A collection of tools which help you to troubleshoot in Window