Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use different protocol (not http) FW will block you.

I would like to run FoundStone against this server via FW. (It's apache server)

Is it possible? How should I do it?

share|improve this question

If you want to run FoundStone against the server through the firewall, you make sure the URI filter won't drop it, so either add the required bits to the traffic or add an exception to the firewall.

They both have pros and cons:

  • Running FoundStone with an exception in the firewall - lets you fully test your server, but is not a realistic test, and it opens up a new hole in the firewall, which may increase your risk

  • Tweaking its scan options to include the URIFilter will not get as wide a scan, but will be relatively realistic.

My preferred option - use something else as well from inside the firewall, whether it be quarterly automated scans, annual penetration tests or whatever.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.