A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

0
votes
0answers
19 views

viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

I am facing the problem "MyViewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem"- i have successfully completed my task and all are working fine. Issue ...
2
votes
3answers
78 views

Can attackers leverage a sites SSL to “hide” attacks from a IPS?

I am running an IDS on the outside of my firewall (I know not ideal) and an IDS on the inside of my LAN running the same detection algorithms and definitions. My website auto redirects all HTTP ...
0
votes
2answers
30 views

Wondering about open port found while using VPN service

I have noticed during port scanning that my "anonymous" IP has an open port (111) while I am using VPN. Does this make me vulnerable as user or is it the provider's failure? Should I change ...
1
vote
2answers
71 views

What phases does a network penetration test consist of?

What are common phases of a network infrastructure penetration test? Staring with discovering IP's and ports? A simple vulnerability assessment, checking version information of banners from different ...
0
votes
0answers
38 views

Frequency of Stealth scan?

Background I am working on snort Portscan Module to detect Stealth scans.Snort uses good amount of datastructures to capture scanning events and to explicitly set the threshold values. typedef ...
0
votes
0answers
15 views

Golismero scanner is not reporting

I'm trying to use Golismero scanner which I found out to be a very good web scanner for vulnerabilities with lots of tests and tools, etc. It is a scanner that comes with BlackArch Linux and Kali ...
1
vote
0answers
34 views

How do I create multiple vulnerability scanners on the public cloud? [migrated]

Let us say I have a large IP range (a x.x.x.x/8 CIDR). What would be a way to efficiently deploy multiple instances of vulnerability scanners on the public cloud to scan that IP range in a period of 1 ...
1
vote
1answer
35 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
5
votes
2answers
46 views

Patterns for searching a source repository for private data

I recently discovered a case where a colleague had accidentally committed their login credentials (host, username, and password) to a local source code repository, and then pushed these changes to a ...
0
votes
3answers
40 views

Vulnerability management solution evaluation criteria

We are planning for a vulnerability management solution, so I am looking out for evaluation criteria between the well known solutions like Nessus, Qualys and Nexpose. If anyone could share such ...
1
vote
2answers
101 views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
0
votes
2answers
111 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
1
vote
0answers
41 views

“Rollback process” for different penetration testing in case of something goes wrong? [closed]

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
5
votes
1answer
116 views

How to detect suspicious content in a TrueType Font (.ttf) font file

I got curious about how to scan or assess the risk of a particular font file before deploying it to hosts. First line of defense, of course, is to make sure that our hosts are patched against any ...
5
votes
3answers
79 views

CVEs aggregated by programming language?

Is there a way to search the CVE database by programming language? For instance, I'd consider CVE-2015-4852 to be a Java-specific vulnerability as the scope of the vulnerability is the commons-...
5
votes
0answers
41 views

How could I train a ML system to identify vulnerabilities in code? [closed]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
5
votes
2answers
101 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
0
votes
0answers
22 views

Where can I find the w3af attack plugins?

I am reading the documentation of w3af (a famous and very practical program to scan web servers for vulnerabilities). There I read that there is type of plugin called "attack plugins", but I can't ...
3
votes
1answer
56 views

SHA 1 no impact to root certificate

I ran a scan on a server and the results of the authentication for digital certificate was as follows : Certificate 1 (root) signature algorithm: Sha256withRSA Certificate 2 (chain of trust) ...
13
votes
4answers
4k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
1
vote
1answer
92 views

Is OpenVas an active or passive scanner? [closed]

I am using Ossim and I did a scan vulnerabilities with OpenVas. I received feedback that some of our softwares broke after the scan. We will check the logs to see if the scan cause this, but I was ...
8
votes
1answer
262 views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
2
votes
1answer
70 views

Is possible for a vulnerability search engine to detect the ipv6 adresses?

Using IPV4 protocol, vulnerability search engines can detect and index Internet connected devices. It will be easy for a hacker to collect a lot of information about some devices and perform an attack....
1
vote
2answers
52 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
0
votes
1answer
53 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
1
vote
1answer
158 views

Nessus report shows iSCSI vulnerability

The IT Manager (my boss) has been running a vulnerabilities scan on a network of servers we have. The report has come back with some interesting vulnerabilities. The one I can't seem to find a lot on ...
0
votes
1answer
42 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
0
votes
1answer
38 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
-1
votes
1answer
131 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their customers....
0
votes
1answer
95 views

How does Netsparker extract the version of SQL Server during a SQL injection?

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities. However I am surprised as the injection query throw error for casting and the scanner ...
3
votes
1answer
413 views

OpenSSH < 7.0 Multiple vulnerabilities question

Nessus reports this as Critical however there are issues such as 'CVE-2015-5600' that CVE is 8.5 but Red Hat reports it as a 'Low' issue. https://access.redhat.com/security/cve/CVE-2015-5600 Reports ...
8
votes
2answers
117 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
-2
votes
1answer
127 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
6
votes
1answer
689 views

Industry best practices for vulnerability scanning and management?

I am looking for reference documents or talks as to the end results for a vulnerability assessment, scanning, and management process at a fully matured "impressive" level for a large organization that ...
-2
votes
1answer
136 views

Check which ports are left open (vulnerable) and accessible in Windows OS from the Internet

Since open ports are a security risk, I would like to know which ports are open to the Internet (outside my network). I wouldn't think of all open ports as security vulnerabilities just the ones ...
1
vote
1answer
462 views

Vulnerability scanning of AngularJS web app fails due to '#' in url

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format http://domain....
5
votes
1answer
48 views

Safely Experimenting With Sockets

I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios: 1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on ...
4
votes
1answer
54 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
4
votes
2answers
182 views

IBM AppScan false positive

I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue. How is AppScan able to find vulnerabilities while I ...
0
votes
2answers
334 views

Virus-total offline Alternatives [duplicate]

These days I am working on FUDing my own written backdoor, RATs, etc. what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?
3
votes
1answer
260 views

Received UDP packet with IP ID of zero:

I am scanning a host in our network with Nexpose and one of the vulnerabilities reported is Received UDP packet with IP ID of zero: IPv4 SRC[10.0.0.5] TGT[127.0.0.1] TOS[192] TTL[64] Flags[40] Proto[...
0
votes
0answers
33 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
3
votes
4answers
261 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
-2
votes
1answer
49 views

Web Application Security Scanner Identification [duplicate]

We got following URLs in our access logs. No referrer. Chrome user agent. Looks like some security scanner is/was at work. Is it possible to identify it? Many urls have references to netsparker. / /'/...
0
votes
2answers
70 views

SQLMap using “?ref=”

I'm learning about net security and how to deal with SQLmap. A friend made some demo web pages on his server to test SQLmap. One of the pages is a fake phishing site with a refer to a real site (index....
3
votes
1answer
50 views

Should we keep our penetration testing environment separate from other test infrastructure?

Given that there are N number of hosts on a given network being used for different purpose, should we place a machine for penetration testing or vulnerability scanning on same LAN or should we have ...
1
vote
0answers
176 views

Can I use OpenVAS to keep up with Cisco security advisories?

I'm assuming this question is more security-centric so I'm posting it here instead of server fault. I'm new to automated vulnerability scanning and I'm trying to wrap my head around what OpenVAS does ...
2
votes
2answers
185 views

Web site vulnerability discovery by scanner

I have a web site which require user login and password before they can access any materials and use the services. However, a recent VA scan found that one URL link is vulnerable to a an old version ...
3
votes
1answer
677 views

How to Verify Qualys QID 42366 - SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Server Side Vulnerability (BEAST)

My company uses Qualys to scan for vulnerabilities in our apps. I received a report with four vulnerabilities (related to SSLv3 and ciphers), and I could google each one and land on page from Qualys ...
11
votes
4answers
461 views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...