A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

-2
votes
0answers
16 views

Comparison of Vulnerability Scanners [on hold]

I would like to have a comparison of Network Vulnerability scanners (Not web application scanners). Could some one recommend me a website where this is possible ? Gartner doesn't seem to have one. ...
-3
votes
0answers
35 views

Any One Who Can Bypass Web Sultan Webapplication Firewall [on hold]

Any One Here in this Panel Who Can bypass this WebSultan xss based firewall link: http://anonkhan.host56.com
1
vote
0answers
39 views

Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses [migrated]

I am wanting to scan a site (which I do not own) to see if they are vulnerable to anything like Heartbleed or the POODLE attack, not because I want to exploit any such vulnerabilities for malicious ...
1
vote
3answers
38 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
3
votes
0answers
57 views

Approach business(es) with security vulnerabilities

As a security researcher, I have become familiar with different related tools and software packages. The other day, I opened up one of those software packages and was attempting to attack a personal ...
0
votes
0answers
33 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
1
vote
0answers
28 views

Add custom information to OpenVas reports [closed]

I am using OpenVas to scan several different networks and aggregate those reports into RSA Archer. Archer supports breaking hardware up into different Business Units/Divisions etc., and I would like ...
0
votes
2answers
79 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
0
votes
1answer
257 views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
1
vote
3answers
81 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
1
vote
1answer
38 views

Credentials for scanning a database server's vulnerabilities [closed]

what is the required credentials for scanning a database server's vulnerabilities by using vulnerability assessment tools such as Rapid 7 Nexpose?
0
votes
1answer
16 views

openvas omp tool is not able to parse target option

I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error. $ omp -u test -w ...
1
vote
0answers
190 views

Error when adding new credentials to OpenVAS [closed]

Google isn't providing me with any helpful answers. I'm running Kali Linux 64bit, with OpenVas running. I am able to run scans fine, and read results in Greenbone. However when I try to create a LSC ...
1
vote
1answer
44 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
4
votes
2answers
604 views

How to use a port scanner in a hostile manner

Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more ...
1
vote
1answer
49 views

Multiple vulnerabilities scanners at the same target

Is it safe/possible to run multiple vulnerabilities scanners on the same target simultaneously?
0
votes
0answers
189 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
2
votes
1answer
60 views

Freelance web app tester law on breach after scan [closed]

If I was to do a web app test on a companies site and I didn't spot something and the company was breached via the app I tested what come back could I possibly have ? How could I protect myself ...
1
vote
0answers
202 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...
3
votes
3answers
636 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
2
votes
3answers
104 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
-2
votes
2answers
98 views

Will cyber security be around forever? [closed]

As time goes on, won't computers be able to automatically test for vulnerabilities to the point where they will not be prevalent any more? What I'm essentially asking is will information security be ...
0
votes
3answers
143 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
0
votes
1answer
129 views

Operating system scanner

I am confused about Operating Systems scanner vs Network Scanner. Usually a network scanner such as Nessus can already check for operating systems vulnerability. So what does an operating system ...
2
votes
2answers
531 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
0
votes
1answer
710 views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
5
votes
2answers
513 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
8
votes
3answers
1k views

Is there a best practice to handle vulnerability scanning attempts?

We've found a number of attempts to access non-existent pages in our IIS logs, specifically a lot of variations on phpMyAdmin URLs. My kneejerk reaction would be to block these IPs, but I have a ...
2
votes
1answer
532 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
27
votes
1answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
6
votes
3answers
4k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
4
votes
1answer
185 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
1
vote
2answers
133 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
2
votes
3answers
370 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
2
votes
2answers
177 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
2
votes
2answers
417 views

Web Application Vulnerability Scan- False Positives-Recognizing and Eliminating

Web Application Vulnerability and Potential False Positives As a Penetration Tester the application vulnerability scan is a major part of any penetration testing methodology. In the Application ...
-1
votes
3answers
286 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
1
vote
0answers
79 views

Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]

I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing: echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> ...
1
vote
2answers
550 views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
5
votes
1answer
3k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
0
votes
1answer
103 views

Retina tells me I do not have permission to scan a range. I have full permissions. Why? [closed]

I am using Retina via BeyondInsight 5.2.0.410 to scan my network. Occasionally, I get the error message "You do not have the required permissions to scan the entered range" which doesn't make sense ...
-1
votes
1answer
186 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
0
votes
0answers
16 views

If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why? [duplicate]

If you were in charge of web application security and needed vulnerability scanner and had option between static code or dynamic code analysis which one would you prefer? (Of course, I realize, having ...
0
votes
2answers
227 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
0
votes
1answer
183 views

Why does OpenVAS report CVE-2003-0042 when my server isn't running Tomcat?

OpenVAS reports that an Apache virtual host is vulnerable to CVE-2003-0042, which is a vulnerability in versions of Tomcat prior to 3.3.1a. The host is not running Tomcat. The detection OID is ...
1
vote
2answers
303 views

Are web vulnerability scanners active or passive?

I want to scan my own website for vulnerabilities using Vega and w3af from kali linux. I assume these tools perform active attacks, not passive ones. Is this correct? If they do perform active ...
0
votes
0answers
76 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
2
votes
2answers
307 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-1
votes
1answer
146 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
0
votes
1answer
180 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...