A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

-1
votes
0answers
38 views

Any good Alternatives to ControlScan PCI SQA? [closed]

My company is about to engace ControlScan for their PCI 1,2,3 solution giving us enough to have our hosting and service PCI compliant. Basically We are in need of a good Web Application Firewall, a ...
0
votes
1answer
52 views

Retina tells me I do not have permission to scan a range. I have full permissions. Why? [closed]

I am using Retina via BeyondInsight 5.2.0.410 to scan my network. Occasionally, I get the error message "You do not have the required permissions to scan the entered range" which doesn't make sense ...
-2
votes
1answer
64 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
0
votes
0answers
16 views

If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why? [duplicate]

If you were in charge of web application security and needed vulnerability scanner and had option between static code or dynamic code analysis which one would you prefer? (Of course, I realize, having ...
0
votes
2answers
67 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
0
votes
1answer
38 views

Why does OpenVAS report CVE-2003-0042 when my server isn't running Tomcat?

OpenVAS reports that an Apache virtual host is vulnerable to CVE-2003-0042, which is a vulnerability in versions of Tomcat prior to 3.3.1a. The host is not running Tomcat. The detection OID is ...
1
vote
2answers
95 views

Are web vulnerability scanners active or passive?

I want to scan my own website for vulnerabilities using Vega and w3af from kali linux. I assume these tools perform active attacks, not passive ones. Is this correct? If they do perform active ...
0
votes
0answers
52 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
2
votes
1answer
120 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-1
votes
1answer
57 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
0
votes
1answer
90 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
0
votes
0answers
26 views

How can I get a list of unsigned plugins in openvas?

How can I get a list of unsigned plugins in openvas? Are those plugins safe for use? When I run the scan on a test machine with nasl_no_signature_check = no, I don't get any results(not even any ...
0
votes
1answer
54 views

Can a nessus scan running on top of a Windows OS do full internal scans of devices using ssh?

I am wondering if I did a Nessus scan using a Windows machine how it would log in to a Linux based device. Windows does not have a native ssh client. I am aware that Nessus will log into systems ...
2
votes
1answer
93 views

Do heuristics exist for modeling the “harmlessness” of a file?

There's a file processing service that looks for some know attacks and sometimes returns messages like: Probably harmless! There are strong indicators suggesting that this file is safe to use. ...
3
votes
2answers
117 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
0
votes
1answer
78 views

Does the use of plugin-id make the nessus scan intrusive in some way?

I want to know when scanning using NESSUS, though it is said its non-intrusive by default But what I want to know is how the use / definition or the testing conditions mentioned in the plugin-id ...
0
votes
2answers
76 views

Where can I practice MITM raw binary protocols?

I want to try practicing MITMing raw TCP binary protocols as well as MITMing HTTP protocol. What is the best way to do this? Are there any specific tools which help me do this? Like wireshark or ZAP ...
0
votes
2answers
209 views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
-1
votes
1answer
41 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
0
votes
3answers
88 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
3answers
82 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
1answer
280 views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a wordpress site ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that ...
1
vote
2answers
319 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
3answers
157 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
1
vote
0answers
42 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
1
vote
0answers
106 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
2answers
121 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
0
votes
2answers
909 views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
1
vote
0answers
210 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
2
votes
2answers
939 views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
1
vote
2answers
268 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
3
votes
1answer
103 views

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
1
vote
1answer
1k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
230 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
458 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
117 views

Organizing scheduled vulnerability scans

I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
0
votes
1answer
661 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
2
votes
1answer
130 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
0
votes
2answers
498 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
2
votes
5answers
460 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
7
votes
1answer
348 views

How do vulnerability scanners detect when DEBUG is set to True on ASP.NET applications

I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this. I've ...
10
votes
2answers
534 views

How can a network observer identify computers running old versions of Java?

I received an email earlier today from my ISP (a university). The email reads (in part): Your network connection has been disabled because your version of Java is not patched for the most recent ...
1
vote
3answers
283 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
-2
votes
1answer
94 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
8
votes
1answer
2k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
10
votes
4answers
409 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
2
votes
1answer
1k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
6
votes
1answer
248 views

Is it dangerous “Powered by…” tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
4
votes
1answer
125 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
0
votes
1answer
697 views

how to access to arachni scanner web interface? [closed]

I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner. I run it but no web page appears. I just see these lines: ...