0
votes
1answer
73 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
7
votes
2answers
8k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
383 views

vulnerabilities in a machine that detects vulnerability scanners

I currently have a machine (set by another person) that has (according to nmap) open ports as: FreeBSD ftpd 6.00LS where anonymous login is possible OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0) ...
5
votes
6answers
476 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...