Tagged Questions
3
votes
1answer
79 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
-5
votes
1answer
120 views
How to find bugs/ vulnerabilities in web apps/sites? [closed]
What knowledge is needed?
What software is to be used?
How are the reports written? PS: Websites like facebook.com
-4
votes
1answer
419 views
Best free website vulnerability scanners [closed]
I need to check web security and vulnerability in my web application. Whatever free vulnerability scanners application or vulnerability scan online site's are available?
1
vote
3answers
319 views
Sample vulnerable web apps to test Pentesting platforms
I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
1
vote
0answers
254 views
Comparison of Whitehat Security and Veracode [closed]
I'm a research student. My topic is Web Application Security Scanners. The companies under my study are WhiteHat Security, Cenzic, Veracode, Qualys, IBM Rational Appscan, HP WebInspect, Fortify.
I'm ...
8
votes
3answers
294 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
3
votes
1answer
118 views
Suddenly scans for 'formvars.php'
Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file:
/somerealpath/includes/formvars.php
I'm ...
3
votes
2answers
826 views
Scanning DVWA with w3af - Unable to detect SQLi when security on low
I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
3answers
1k views
How to exploit this SQL inection vulnerability?
I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is :
SQL injection in a Microsoft SQL database was found at: ...
12
votes
2answers
494 views
How can I test my web application for timing attacks?
race conditions, etc.
Are there automatic tools for this? What manual techniques should I use?
From the Area51 proposal
