FoundStone scan + URI filtering

Question

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use different protocol (not http) FW will block you.

I would like to run FoundStone against this server via FW. (It's apache server)

Is it possible? How should I do it?

Answer 1

If you want to run FoundStone against the server through the firewall, you make sure the URI filter won't drop it, so either add the required bits to the traffic or add an exception to the firewall.

They both have pros and cons:

• Running FoundStone with an exception in the firewall - lets you fully test your server, but is not a realistic test, and it opens up a new hole in the firewall, which may increase your risk

• Tweaking its scan options to include the URIFilter will not get as wide a scan, but will be relatively realistic.

My preferred option - use something else as well from inside the firewall, whether it be quarterly automated scans, annual penetration tests or whatever.