A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

0
votes
1answer
2k views

how to access to arachni scanner web interface? [closed]

I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner. I run it but no web page appears. I just see these lines: ...
0
votes
1answer
217 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
0
votes
0answers
31 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
0
votes
1answer
16 views

openvas omp tool is not able to parse target option

I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error. $ omp -u test -w ...
0
votes
0answers
183 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
0
votes
0answers
16 views

If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why? [duplicate]

If you were in charge of web application security and needed vulnerability scanner and had option between static code or dynamic code analysis which one would you prefer? (Of course, I realize, having ...
0
votes
1answer
181 views

Why does OpenVAS report CVE-2003-0042 when my server isn't running Tomcat?

OpenVAS reports that an Apache virtual host is vulnerable to CVE-2003-0042, which is a vulnerability in versions of Tomcat prior to 3.3.1a. The host is not running Tomcat. The detection OID is ...
0
votes
0answers
75 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
0
votes
1answer
126 views

Can a nessus scan running on top of a Windows OS do full internal scans of devices using ssh?

I am wondering if I did a Nessus scan using a Windows machine how it would log in to a Linux based device. Windows does not have a native ssh client. I am aware that Nessus will log into systems ...
0
votes
1answer
332 views

Nessus doesn't find self-written plugins [closed]

I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line display("hello world"); in the appropriate section and altered the script_id to a non-existing one. ...
-1
votes
3answers
279 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
-1
votes
2answers
213 views

How do you search for new vulnerabilities? [closed]

I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
-1
votes
1answer
184 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
-1
votes
1answer
143 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
-1
votes
1answer
45 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
-2
votes
2answers
2k views

What are the limitations of vulnerability scanners?

What are the limitations of vulnerability scanners? If it is related to how these scanners work, how these work?
-2
votes
2answers
97 views

Will cyber security be around forever? [closed]

As time goes on, won't computers be able to automatically test for vulnerabilities to the point where they will not be prevalent any more? What I'm essentially asking is will information security be ...
-2
votes
1answer
112 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
-3
votes
1answer
180 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
-5
votes
1answer
340 views

How to scan internet? [closed]

I was wondering if you know how to portscan internet and be compliant with law. I mean a SYN scan and a little UDP one. Such database would be very useful, and should be public anyway. I think this ...
-5
votes
1answer
797 views

Best free website vulnerability scanners [closed]

I need to check web security and vulnerability in my web application. Whatever free vulnerability scanners application or vulnerability scan online site's are available?
-6
votes
1answer
3k views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com