A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

1
vote
1answer
317 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
2
votes
4answers
619 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
0
votes
1answer
367 views

Nessus doesn't find self-written plugins [closed]

I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line display("hello world"); in the appropriate section and altered the script_id to a non-existing one. ...
-5
votes
1answer
352 views

How to scan internet? [closed]

I was wondering if you know how to portscan internet and be compliant with law. I mean a SYN scan and a little UDP one. Such database would be very useful, and should be public anyway. I think this ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
6
votes
3answers
585 views

How do I test and secure ASN.1 Parsers?

As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
1
vote
3answers
324 views

web application security testing definition [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? When people talk about webapp security testing, do they usually mean vulnerability ...
8
votes
3answers
325 views

Does concealing server software versions have a notable effect on security?

Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
1
vote
2answers
2k views

Vulnerability scanner tools to use with Snort

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
3
votes
2answers
3k views

Is SNMPing available anymore?

I am researching SNMP and I read about a scanning tool from SANS called SNMPing. Is this tool still available? I cannot find anywhere to download it. Sending an empty email to snmptool@sans.org just ...
8
votes
1answer
2k views

How to Perform Vulnerability Assessment for WCF services

Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
-2
votes
2answers
2k views

What are the limitations of vulnerability scanners?

What are the limitations of vulnerability scanners? If it is related to how these scanners work, how these work?
3
votes
1answer
134 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...
0
votes
1answer
1k views

nessus scan against metasploit exploits

I am thinking about launching wide nessus scans (in the "IP range" sense) against exploits present in metasploit. The idea is to limit the number of plugins so that that the scan finishes in a ...
1
vote
3answers
10k views

PING BLOCKING: How to do? How to break?

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout". I also tried traceroute. ...
3
votes
3answers
4k views

Besides OpenVas and Nessus, what are my other options for vulnerability detection?

I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like). I use Linux so do I have any other options for vulnerability detection?
2
votes
3answers
772 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
2answers
836 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
1
vote
2answers
4k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
5
votes
2answers
2k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
3
votes
1answer
776 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
3
votes
3answers
284 views

Modeling & Simulation: Do vulnerability-scanner software simulators exist?

In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
7
votes
2answers
472 views

What should a Vulnerability Management System scan on a large scale

On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples? I ...
5
votes
3answers
346 views

Is “untrusted code” reported by DOM Snitch a vulnerability?

One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool: Is it a vulnerability? Edit: This report of ...
0
votes
1answer
224 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
9
votes
3answers
250 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
2
votes
1answer
584 views

Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool [closed]

I've see the PVS (passive vulnerability scanner) from Tenable Network Security. I'm really interested in this kind of approach. Anyone know if is there any FOSS solution to be used professionally ...
2
votes
3answers
7k views

How to exploit this SQL injection vulnerability?

I am learning SQL injection on a vulnerable web app. I scanned it with w3af. It showed many vulnerabilities. One of them is: SQL injection in a Microsoft SQL database was found at: ...
6
votes
2answers
1k views

Network Vulnerability Scanner placement on network

We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard. Qualys supply a scanner appliance for the internal network scanning, which ...
13
votes
2answers
31k views

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the ...
2
votes
2answers
283 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
2
votes
2answers
354 views

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only ...
7
votes
3answers
551 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
10
votes
4answers
2k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
7
votes
2answers
7k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
6
votes
6answers
649 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
7
votes
1answer
642 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
13
votes
6answers
20k views

Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
1
vote
2answers
1k views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
4
votes
1answer
794 views

How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?

On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error. It's rather frustrating that these ...
4
votes
2answers
3k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
5
votes
1answer
3k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
11
votes
3answers
4k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
7
votes
8answers
820 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
14
votes
2answers
1k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
19
votes
4answers
6k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
31
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...