A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
3
votes
3answers
4k views

Besides OpenVas and Nessus, what are my other options for vulnerability detection?

I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like). I use Linux so do I have any other options for vulnerability detection?
3
votes
2answers
2k views

Is SNMPing available anymore?

I am researching SNMP and I read about a scanning tool from SANS called SNMPing. Is this tool still available? I cannot find anywhere to download it. Sending an empty email to snmptool@sans.org just ...
3
votes
3answers
624 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
3
votes
5answers
248 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
3
votes
2answers
1k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
3
votes
2answers
917 views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
3
votes
1answer
654 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
3
votes
1answer
134 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...
3
votes
2answers
161 views

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
3
votes
2answers
155 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
3
votes
3answers
268 views

Modeling & Simulation: Do vulnerability-scanner software simulators exist?

In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
3
votes
1answer
227 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
3
votes
2answers
159 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
3
votes
0answers
55 views

Approach business(es) with security vulnerabilities

As a security researcher, I have become familiar with different related tools and software packages. The other day, I opened up one of those software packages and was attempting to attack a personal ...
2
votes
3answers
710 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
2answers
528 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
2
votes
3answers
270 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
2
votes
1answer
244 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
2
votes
5answers
788 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
2
votes
4answers
515 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
2answers
307 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
2
votes
2answers
166 views

Organizing scheduled vulnerability scans

I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
2
votes
2answers
2k views

Why Nessus freezes at 0% and how to fix it?

Does anybody know why Nessus freezes at 0%? I am not sure that I've done the right configuration, but it is becoming painful How long approximately takes to scan one machine?
2
votes
3answers
104 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
2
votes
2answers
177 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
2
votes
2answers
3k views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
2
votes
3answers
5k views

How to use information from GHDB and FSDB (Google-Dorks)?

I am new to information security and analysis. Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool. What are ...
2
votes
3answers
368 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
2
votes
1answer
59 views

Freelance web app tester law on breach after scan [closed]

If I was to do a web app test on a companies site and I didn't spot something and the company was breached via the app I tested what come back could I possibly have ? How could I protect myself ...
2
votes
1answer
526 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
2
votes
2answers
414 views

Web Application Vulnerability Scan- False Positives-Recognizing and Eliminating

Web Application Vulnerability and Potential False Positives As a Penetration Tester the application vulnerability scan is a major part of any penetration testing methodology. In the Application ...
2
votes
1answer
158 views

Do heuristics exist for modeling the “harmlessness” of a file?

There's a file processing service that looks for some know attacks and sometimes returns messages like: Probably harmless! There are strong indicators suggesting that this file is safe to use. ...
2
votes
2answers
384 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
2
votes
2answers
749 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
2
votes
2answers
247 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
2
votes
2answers
311 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
2
votes
3answers
1k views

Sample vulnerable web apps to test Pentesting platforms

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
2
votes
1answer
522 views

Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool [closed]

I've see the PVS (passive vulnerability scanner) from Tenable Network Security. I'm really interested in this kind of approach. Anyone know if is there any FOSS solution to be used professionally ...
1
vote
3answers
9k views

PING BLOCKING: How to do? How to break?

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout". I also tried traceroute. ...
1
vote
2answers
548 views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
1
vote
3answers
315 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
1
vote
4answers
2k views

Antivirus Engine based MD5 or SHA1 hash?

I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more). Why does ClamAV use additional scanning ...
1
vote
2answers
303 views

Are web vulnerability scanners active or passive?

I want to scan my own website for vulnerabilities using Vega and w3af from kali linux. I assume these tools perform active attacks, not passive ones. Is this correct? If they do perform active ...
1
vote
2answers
3k views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
1
vote
2answers
239 views

Vulnerability scan scheduling approach on demand versus change?

I have a question regarding scheduling a vulnerability scanning and assessment exercise. I'm in the process of laying a schedule for vulnerability scans. I'm wondering when and why to initiate the ...
1
vote
2answers
4k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
1
vote
2answers
1k views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
1
vote
2answers
183 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...