A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

2
votes
2answers
560 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
1
vote
2answers
2k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
5
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
2
votes
1answer
403 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
2
votes
2answers
211 views

Modeling & Simulation: Do vulnerability-scanner software simulators exist?

In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
7
votes
2answers
262 views

What should a Vulnerability Management System scan on a large scale

On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples? I ...
5
votes
3answers
260 views

Is “untrusted code” reported by DOM Snitch a vulnerability?

One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool: Is it a vulnerability? Edit: This report of ...
0
votes
1answer
173 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
8
votes
3answers
191 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
2
votes
1answer
410 views

Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool

I've see the PVS (passive vulnerability scanner) from Tenable Network Security. I'm really interested in this kind of approach. Anyone know if is there any FOSS solution to be used professionally ...
0
votes
3answers
4k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
4
votes
2answers
812 views

Network Vulnerability Scanner placement on network

We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard. Qualys supply a scanner appliance for the internal network scanning, which ...
8
votes
2answers
16k views

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the ...
2
votes
2answers
218 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
2
votes
2answers
265 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
3
votes
1answer
477 views

Good software for IT Infrastructure discovery

Currently, I have an industry attachment project in which my group need to suggest a good tool for Network discovery to a IT service company. The company wants to automate the stage in which they have ...
7
votes
3answers
448 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
8
votes
4answers
1k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
6
votes
2answers
5k views

Testing SQL injection using sqlmap

I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks. I got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
5
votes
6answers
472 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
7
votes
1answer
480 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
10
votes
4answers
9k views

Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
1
vote
2answers
993 views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
3
votes
4answers
1k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
4
votes
1answer
517 views

How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?

On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error. It's rather frustrating that these ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
5
votes
1answer
2k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
10
votes
3answers
2k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities?

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
6
votes
8answers
660 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
13
votes
2answers
699 views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
18
votes
4answers
3k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
16
votes
4answers
2k views

Open-source penetration-test automation

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test? Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...