Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my website I have an sql injection vulnerability.

But when I scan my website with Nessus under "Web app tests" there is no result on sql injection.

Why is this? What should I do to make this work?

share|improve this question

closed as not a real question by AviD Dec 19 '12 at 11:04

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Ok then. What's your question? – Polynomial Dec 19 '12 at 10:59
Welcome to Information Security. Nessus is a network scanner. You really shouldnt expect a rigorous application scan, even if you might get lucky on occassion. Besides, there is no real question here... – AviD Dec 19 '12 at 11:03
edited to try and make it a question... – Rory Alsop Dec 19 '12 at 11:05
Try sqlmap ; it is the library Metasploit uses. – Chad Brewbaker Dec 19 '12 at 17:56

Nessus is just a tool - it can do things you configure it to, but it is not intelligent in any way.

If you are detecting SQL as an authenticated user, Nessus will not be able to do this unless you allow it to authenticate to your application

If you are detecting it at a specific URL, you need to make sure Nessus is looking at that URL and that it is checking it for SQL.

Many things Nessus misses are down to misconfiguration or permissions, but even once you have set a tool up perfectly, they all have false positives and negatives - which incidentally is why any solely-tool based security scan should not be relied on without manual confirmation!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.