A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

3
votes
1answer
446 views

Good software for IT Infrastructure discovery

Currently, I have an industry attachment project in which my group need to suggest a good tool for Network discovery to a IT service company. The company wants to automate the stage in which they have ...
3
votes
1answer
139 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
3
votes
2answers
109 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
2
votes
3answers
572 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
1answer
116 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
2
votes
5answers
293 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
2
votes
2answers
266 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
2
votes
2answers
97 views

Organizing scheduled vulnerability scans

I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
2
votes
2answers
961 views

Why Nessus freezes at 0% and how to fix it?

Does anybody know why Nessus freezes at 0%? I am not sure that I've done the right configuration, but it is becoming painful How long approximately takes to scan one machine?
2
votes
3answers
997 views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
3answers
3k views

How to use information from GHDB and FSDB (Google-Dorks)?

I am new to information security and analysis. Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool. What are ...
2
votes
1answer
363 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
2
votes
2answers
264 views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
2
votes
1answer
620 views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
2
votes
2answers
291 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
2
votes
2answers
516 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
2
votes
2answers
203 views

Modeling & Simulation: Do vulnerability-scanner software simulators exist?

In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
2
votes
2answers
210 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
2
votes
2answers
247 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
2
votes
1answer
382 views

Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool

I've see the PVS (passive vulnerability scanner) from Tenable Network Security. I'm really interested in this kind of approach. Anyone know if is there any FOSS solution to be used professionally ...
1
vote
3answers
5k views

PING BLOCKING: How to do? How to break?

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout". I also tried traceroute. ...
1
vote
3answers
133 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
1
vote
3answers
269 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
1
vote
4answers
1k views

Antivirus Engine based MD5 or SHA1 hash?

I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more). Why does ClamAV use additional scanning ...
1
vote
2answers
163 views

Vulnerability scan scheduling approach on demand versus change?

I have a question regarding scheduling a vulnerability scanning and assessment exercise. I'm in the process of laying a schedule for vulnerability scans. I'm wondering when and why to initiate the ...
1
vote
2answers
2k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
1
vote
2answers
939 views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
1
vote
2answers
106 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
1
vote
2answers
114 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
1
vote
3answers
151 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
1
vote
1answer
677 views

Pre Installed OpenVAS , light way Linux [closed]

Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ? I have used Back Track (UBUNTU ...
1
vote
1answer
3k views

my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it

I am supposed to manage the content of a site and it got defaced. The site is hosted on a Linux server running Apache. Apache version: 2.2.13 Linux version is Debian 4.0(I think I don't really have ...
1
vote
2answers
233 views

Changing IP ID generation of a server

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into ...
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
347 views

vulnerabilities in a machine that detects vulnerability scanners

I currently have a machine (set by another person) that has (according to nmap) open ports as: FreeBSD ftpd 6.00LS where anonymous login is possible OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0) ...
1
vote
2answers
100 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
1answer
77 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
1
vote
1answer
213 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
1
vote
3answers
271 views

web application security testing definition [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? When people talk about webapp security testing, do they usually mean vulnerability ...
1
vote
2answers
1k views

Vulnerability scanner tools to use with Snort

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
1
vote
0answers
28 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
1
vote
0answers
29 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
0answers
86 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
3answers
492 views

Sample vulnerable web apps to test Pentesting platforms

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
1
vote
0answers
463 views

Comparison of Whitehat Security and Veracode [closed]

I'm a research student. My topic is Web Application Security Scanners. The companies under my study are WhiteHat Security, Cenzic, Veracode, Qualys, IBM Rational Appscan, HP WebInspect, Fortify. I'm ...
0
votes
3answers
3k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
0
votes
2answers
398 views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
0
votes
1answer
541 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
0
votes
3answers
44 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
2answers
303 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...