0
votes
1answer
63 views

How to determinate if someone scanning my server?

How is possible to determinate if someone make requests with tools for pentesting? Is there any linux command?
-2
votes
1answer
72 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
1
vote
2answers
118 views

Are web vulnerability scanners active or passive?

I want to scan my own website for vulnerabilities using Vega and w3af from kali linux. I assume these tools perform active attacks, not passive ones. Is this correct? If they do perform active ...
0
votes
2answers
303 views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
4
votes
1answer
128 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
-2
votes
1answer
121 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
-6
votes
1answer
1k views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com
3
votes
5answers
213 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
5
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
1answer
182 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
0
votes
3answers
4k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
5
votes
1answer
2k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...