A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

0
votes
1answer
252 views

Does the use of plugin-id make the nessus scan intrusive in some way?

I want to know when scanning using NESSUS, though it is said its non-intrusive by default But what I want to know is how the use / definition or the testing conditions mentioned in the plugin-id ...
0
votes
2answers
131 views

Where can I practice MITM raw binary protocols?

I want to try practicing MITMing raw TCP binary protocols as well as MITMing HTTP protocol. What is the best way to do this? Are there any specific tools which help me do this? Like wireshark or ZAP ...
0
votes
2answers
1k views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
-1
votes
1answer
45 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
0
votes
3answers
205 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
3answers
169 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
1
vote
2answers
565 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
2
votes
3answers
262 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
1
vote
0answers
60 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
1
vote
0answers
226 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
2answers
175 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
1
vote
2answers
3k views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
1
vote
0answers
406 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
2answers
2k views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
1
vote
2answers
523 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
3
votes
1answer
143 views

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
1
vote
1answer
4k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
394 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
850 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
159 views

Organizing scheduled vulnerability scans

I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
0
votes
1answer
1k views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
2
votes
1answer
220 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
0
votes
2answers
760 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
2
votes
5answers
741 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
7
votes
1answer
791 views

How do vulnerability scanners detect when DEBUG is set to True on ASP.NET applications

I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this. I've ...
10
votes
2answers
689 views

How can a network observer identify computers running old versions of Java?

I received an email earlier today from my ISP (a university). The email reads (in part): Your network connection has been disabled because your version of Java is not patched for the most recent ...
1
vote
3answers
312 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
-2
votes
1answer
112 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
8
votes
1answer
2k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
10
votes
4answers
512 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
4
votes
1answer
2k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
8
votes
1answer
269 views

Is it dangerous “Powered by…” tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
4
votes
1answer
156 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
0
votes
1answer
2k views

how to access to arachni scanner web interface? [closed]

I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner. I run it but no web page appears. I just see these lines: ...
-1
votes
2answers
210 views

How do you search for new vulnerabilities? [closed]

I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
1
vote
1answer
100 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
-2
votes
1answer
177 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
4
votes
1answer
625 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
6
votes
3answers
427 views

Failed PCI-DSS Compliance | Submitting Evidence

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
10
votes
1answer
5k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
2
votes
3answers
5k views

How to use information from GHDB and FSDB (Google-Dorks)?

I am new to information security and analysis. Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool. What are ...
3
votes
1answer
218 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
13
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
8
votes
2answers
15k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
11
votes
2answers
886 views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
-6
votes
1answer
3k views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com
3
votes
2answers
150 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
1
vote
1answer
862 views

Pre Installed OpenVAS , light way Linux [closed]

Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ? I have used Back Track (UBUNTU ...
0
votes
2answers
810 views

Recomended Nessus Windows-7 scan settings?

In the Nessus FAQ it says Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete ...