A friend of mind run a webstore that was hacked last month. Unfortunately due to a change in the CC module the site was storing the full 16 digits not just the last 4 as it previously did. This has resulted in several of his customers, including me, having their CC numbers stolen.

What I am wondering is are their products out there that he can use to verify that there are no know flaws in his site that could be used to hack it? It uses osCommerce.

If only it were so simple. There's a whole industry of consultants who offer their time to help people like your friend secure their sites, and there are some automated tools out there, particularly for finding things like buffer overflows, but security auditing is still largely a manual process done by experts.

SQL Injection, Cross Site Scripting, known exploits in server software code. Those are the big ones to start with. Once you get those holes closed you are basically just as secure as everybody else.

Like the others said, not really. But if you want to throw money at it, you can place a McAfee or ScanAlert "Hacker Safe" logo on your website for about $1500/year.

I believe it port scans your site everyday looking for known vulnerabilities.