A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
3
votes
2answers
558 views
Is SNMPing available anymore?
I am researching SNMP and I read about a scanning tool from SANS called SNMPing. Is this tool still available?
I cannot find anywhere to download it. Sending an empty email to snmptool@sans.org just ...
5
votes
1answer
520 views
How to Perform Vulnerability Assessment for WCF services
Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
-2
votes
2answers
421 views
What are the limitations of vulnerability scanners?
What are the limitations of vulnerability scanners?
If it is related to how these scanners work, how these work?
Thanks very much.
3
votes
1answer
118 views
Suddenly scans for 'formvars.php'
Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file:
/somerealpath/includes/formvars.php
I'm ...
0
votes
1answer
640 views
nessus scan against metasploit exploits
I am thinking about launching wide nessus scans (in the "IP range" sense) against exploits present in metasploit. The idea is to limit the number of plugins so that that the scan finishes in a ...
0
votes
3answers
1k views
PING BLOCKING: How to do? How to break?
I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout".
I also tried traceroute. ...
3
votes
3answers
1k views
Besides OpenVas and Nessus, what are my other options for vulnerability detection?
I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like).
I use Linux so do I have any other options for vulnerability detection?
2
votes
3answers
480 views
How does Facebook avoid crawling over their site?
I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
2answers
333 views
How do I find .asmx files?
I have a web service (ASP.NET) running on my application server. It can be reached via
http://xxxxxx/Servercomponents/servercomp.asmx
Is possible to find this even if you don't know the file name ...
1
vote
2answers
1k views
What is the best tool to anonymize your scans (network/ports)? [closed]
What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...?
I have been using Backtrack and tor network with proxychains to do this, but ...
3
votes
2answers
824 views
Scanning DVWA with w3af - Unable to detect SQLi when security on low
I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
2
votes
1answer
261 views
Can fuzzing be considered a software testing technique for any vulnerability type
I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar
...
2
votes
2answers
170 views
Modeling & Simulation: Do vulnerability-scanner software simulators exist?
In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
5
votes
2answers
155 views
What should a Vulnerability Management System scan on a large scale
On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?
I ...
5
votes
3answers
205 views
Is “untrusted code” reported by DOM Snitch a vulnerability?
One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool:
Is it a vulnerability?
Edit: This report of ...
0
votes
1answer
135 views
FoundStone scan + URI filtering
I have a server that is protected with a firewall with URI filtering rule.
So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
8
votes
3answers
153 views
would threat modeling help in scanning code?
threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
2
votes
1answer
274 views
Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool
I've see the PVS (passive vulnerability scanner) from Tenable Network Security.
I'm really interested in this kind of approach.
Anyone know if is there any FOSS solution to be used professionally ...
0
votes
3answers
1k views
How to exploit this SQL inection vulnerability?
I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is :
SQL injection in a Microsoft SQL database was found at: ...
4
votes
2answers
472 views
Network Vulnerability Scanner placement on network
We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard.
Qualys supply a scanner appliance for the internal network scanning, which ...
7
votes
2answers
8k views
nmap scan shows ports are filtered but nessus scan shows no result
I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered
When I perform a nessus scan on the ...
2
votes
2answers
168 views
Scan Novell NetWare backend with Windows servers and clients
Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows?
...
2
votes
2answers
203 views
PCI Scanning and authenticated user pages
I've just used a security vendor's automated PCI scanning tool to scan my web server.
It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
2
votes
1answer
356 views
Good software for IT Infrastructure discovery
Currently, I have an industry attachment project in which my group need to suggest a good tool for Network discovery to a IT service company. The company wants to automate the stage in which they have ...
7
votes
3answers
393 views
Which resources can help me learn how to use metasploit?
I tried google search but I can't find good resources to learn how to use the metasploit framework.
Where would you suggest a beginner go to learn about using metasploit?
9
votes
4answers
934 views
How does System Memory Dump work?
So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
5
votes
1answer
3k views
Testing SQL injection using sqlmap
I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks.
I got a website which is vulnerable:
C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
5
votes
6answers
381 views
Determining vulnerable software on client machines
I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
7
votes
1answer
369 views
What evaluation criteria would you use for an Oracle scanning tool?
What evaluation criteria would you use to select the right Oracle scanning tool?
Context:
To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
9
votes
4answers
3k views
Browsing exploits with Metasploit console
Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
1
vote
2answers
744 views
TCP / UDP port monitoring programs for mac?
Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
3
votes
4answers
903 views
Problems during Pen-testing of SCADA systems
Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
4
votes
1answer
336 views
How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?
On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error.
It's rather frustrating that these ...
4
votes
2answers
1k views
Command line Nessus/OpenVAS or NSE to find specific vulns?
Which methods do you use to quickly scan a network for certain vulnerabilities?
I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
5
votes
1answer
2k views
Does WebDAV pose an unreasonable risk in IIS7.5?
I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
8
votes
3answers
878 views
Can anyone suggest good open source tools for scanning source code for vulnerabilities?
I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
6
votes
8answers
590 views
What is the vulnerability in my PHP code?
A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam.
I've taken ...
12
votes
2answers
492 views
How can I test my web application for timing attacks?
race conditions, etc.
Are there automatic tools for this? What manual techniques should I use?
From the Area51 proposal
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
15
votes
4answers
1k views
Open-source penetration-test automation
Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?
Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
