A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

1
vote
1answer
2k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
406 views

vulnerabilities in a machine that detects vulnerability scanners

I currently have a machine (set by another person) that has (according to nmap) open ports as: FreeBSD ftpd 6.00LS where anonymous login is possible OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0) ...
1
vote
2answers
400 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
1answer
2k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
1answer
90 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
1
vote
1answer
263 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
1
vote
3answers
294 views

web application security testing definition [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? When people talk about webapp security testing, do they usually mean vulnerability ...
1
vote
2answers
1k views

Vulnerability scanner tools to use with Snort

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
1
vote
0answers
78 views

Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]

I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing: echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> ...
1
vote
0answers
49 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
1
vote
0answers
159 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
0answers
293 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
3answers
645 views

Sample vulnerable web apps to test Pentesting platforms

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
1
vote
0answers
577 views

Comparison of Whitehat Security and Veracode [closed]

I'm a research student. My topic is Web Application Security Scanners. The companies under my study are WhiteHat Security, Cenzic, Veracode, Qualys, IBM Rational Appscan, HP WebInspect, Fortify. I'm ...
0
votes
3answers
4k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
0
votes
2answers
1k views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
0
votes
2answers
104 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
0
votes
1answer
641 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
0
votes
1answer
75 views

Retina tells me I do not have permission to scan a range. I have full permissions. Why? [closed]

I am using Retina via BeyondInsight 5.2.0.410 to scan my network. Occasionally, I get the error message "You do not have the required permissions to scan the entered range" which doesn't make sense ...
0
votes
2answers
556 views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
0
votes
3answers
113 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
2answers
608 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
0
votes
1answer
108 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
0
votes
2answers
627 views

Recomended Nessus Windows-7 scan settings?

In the Nessus FAQ it says Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete ...
0
votes
1answer
1k views

nessus scan against metasploit exploits

I am thinking about launching wide nessus scans (in the "IP range" sense) against exploits present in metasploit. The idea is to limit the number of plugins so that that the scan finishes in a ...
0
votes
1answer
38 views

What tools are available for iOS vulnerability assessment and penetration testing [on hold]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
0
votes
1answer
75 views

How to determinate if someone scanning my server?

How is possible to determinate if someone make requests with tools for pentesting? Is there any linux command?
0
votes
1answer
112 views

Does the use of plugin-id make the nessus scan intrusive in some way?

I want to know when scanning using NESSUS, though it is said its non-intrusive by default But what I want to know is how the use / definition or the testing conditions mentioned in the plugin-id ...
0
votes
2answers
81 views

Where can I practice MITM raw binary protocols?

I want to try practicing MITMing raw TCP binary protocols as well as MITMing HTTP protocol. What is the best way to do this? Are there any specific tools which help me do this? Like wireshark or ZAP ...
0
votes
3answers
131 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
1answer
568 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
0
votes
1answer
920 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
0
votes
1answer
924 views

how to access to arachni scanner web interface? [closed]

I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner. I run it but no web page appears. I just see these lines: ...
0
votes
1answer
184 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
0
votes
0answers
16 views

If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why? [duplicate]

If you were in charge of web application security and needed vulnerability scanner and had option between static code or dynamic code analysis which one would you prefer? (Of course, I realize, having ...
0
votes
1answer
97 views

Why does OpenVAS report CVE-2003-0042 when my server isn't running Tomcat?

OpenVAS reports that an Apache virtual host is vulnerable to CVE-2003-0042, which is a vulnerability in versions of Tomcat prior to 3.3.1a. The host is not running Tomcat. The detection OID is ...
0
votes
0answers
61 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
0
votes
0answers
40 views

How can I get a list of unsigned plugins in openvas?

How can I get a list of unsigned plugins in openvas? Are those plugins safe for use? When I run the scan on a test machine with nasl_no_signature_check = no, I don't get any results(not even any ...
0
votes
1answer
82 views

Can a nessus scan running on top of a Windows OS do full internal scans of devices using ssh?

I am wondering if I did a Nessus scan using a Windows machine how it would log in to a Linux based device. Windows does not have a native ssh client. I am aware that Nessus will log into systems ...
0
votes
1answer
718 views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a wordpress site ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that ...
0
votes
1answer
268 views

Nessus doesn't find self-written plugins [closed]

I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line display("hello world"); in the appropriate section and altered the script_id to a non-existing one. ...
-1
votes
2answers
192 views

How do you search for new vulnerabilities? [closed]

I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
-1
votes
5answers
1k views

Can I scan with nmap from cloud services? [closed]

Can i conduct nmap scanning from cloud services (i.e AWS)? i am looking to do external scanning for my company and want to set up something that will be quick, efficient, and cheap. I dont want to ...
-1
votes
1answer
79 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
-1
votes
1answer
43 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
-2
votes
2answers
1k views

What are the limitations of vulnerability scanners?

What are the limitations of vulnerability scanners? If it is related to how these scanners work, how these work?
-2
votes
1answer
99 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
-2
votes
1answer
135 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
-2
votes
1answer
90 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
-4
votes
1answer
320 views

How to scan internet? [closed]

I was wondering if you know how to portscan internet and be compliant with law. I mean a SYN scan and a little UDP one. Such database would be very useful, and should be public anyway. I think this ...