A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

-3
votes
0answers
34 views

Any One Who Can Bypass Web Sultan Webapplication Firewall [on hold]

Any One Here in this Panel Who Can bypass this WebSultan xss based firewall link: http://anonkhan.host56.com
1
vote
0answers
39 views

Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses [migrated]

I am wanting to scan a site (which I do not own) to see if they are vulnerable to anything like Heartbleed or the POODLE attack, not because I want to exploit any such vulnerabilities for malicious ...
30
votes
5answers
3k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
1
vote
3answers
36 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
3
votes
0answers
55 views

Approach business(es) with security vulnerabilities

As a security researcher, I have become familiar with different related tools and software packages. The other day, I opened up one of those software packages and was attempting to attack a personal ...
3
votes
2answers
161 views

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
0
votes
0answers
33 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
1
vote
0answers
27 views

Add custom information to OpenVas reports [closed]

I am using OpenVas to scan several different networks and aggregate those reports into RSA Archer. Archer supports breaking hardware up into different Business Units/Divisions etc., and I would like ...
0
votes
1answer
249 views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
0
votes
2answers
79 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
1
vote
3answers
79 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
1
vote
0answers
186 views

Error when adding new credentials to OpenVAS [closed]

Google isn't providing me with any helpful answers. I'm running Kali Linux 64bit, with OpenVas running. I am able to run scans fine, and read results in Greenbone. However when I try to create a LSC ...
1
vote
1answer
38 views

Credentials for scanning a database server's vulnerabilities [closed]

what is the required credentials for scanning a database server's vulnerabilities by using vulnerability assessment tools such as Rapid 7 Nexpose?
0
votes
1answer
16 views

openvas omp tool is not able to parse target option

I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error. $ omp -u test -w ...
1
vote
1answer
44 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
4
votes
2answers
604 views

How to use a port scanner in a hostile manner

Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more ...
6
votes
3answers
4k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
13
votes
5answers
16k views

Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
1
vote
1answer
49 views

Multiple vulnerabilities scanners at the same target

Is it safe/possible to run multiple vulnerabilities scanners on the same target simultaneously?
3
votes
3answers
268 views

Modeling & Simulation: Do vulnerability-scanner software simulators exist?

In my research, i am attempting to develop a simulator that mimics the output of a vulnerability scanner, given a set of parameters (e.g., Network IP ranges, number of machines to scan, typical ...
0
votes
0answers
189 views

I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q ...
2
votes
3answers
104 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
8
votes
3answers
1k views

Is there a best practice to handle vulnerability scanning attempts?

We've found a number of attempts to access non-existent pages in our IIS logs, specifically a lot of variations on phpMyAdmin URLs. My kneejerk reaction would be to block these IPs, but I have a ...
7
votes
2answers
7k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
2
votes
1answer
59 views

Freelance web app tester law on breach after scan [closed]

If I was to do a web app test on a companies site and I didn't spot something and the company was breached via the app I tested what come back could I possibly have ? How could I protect myself ...
1
vote
0answers
200 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...
3
votes
3answers
627 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
-1
votes
3answers
285 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
0
votes
2answers
2k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
-2
votes
2answers
98 views

Will cyber security be around forever? [closed]

As time goes on, won't computers be able to automatically test for vulnerabilities to the point where they will not be prevalent any more? What I'm essentially asking is will information security be ...
0
votes
3answers
143 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
0
votes
1answer
129 views

Operating system scanner

I am confused about Operating Systems scanner vs Network Scanner. Usually a network scanner such as Nessus can already check for operating systems vulnerability. So what does an operating system ...
2
votes
4answers
517 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
0
votes
1answer
702 views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
2
votes
2answers
528 views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
4
votes
1answer
185 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
5
votes
2answers
513 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
10
votes
1answer
5k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
2
votes
1answer
530 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
27
votes
1answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
1
vote
2answers
133 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
3
votes
3answers
4k views

Besides OpenVas and Nessus, what are my other options for vulnerability detection?

I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like). I use Linux so do I have any other options for vulnerability detection?
2
votes
3answers
370 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
2
votes
2answers
177 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
2
votes
2answers
414 views

Web Application Vulnerability Scan- False Positives-Recognizing and Eliminating

Web Application Vulnerability and Potential False Positives As a Penetration Tester the application vulnerability scan is a major part of any penetration testing methodology. In the Application ...
2
votes
2answers
307 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
1
vote
2answers
549 views

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have ...
1
vote
0answers
79 views

Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]

I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing: echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> ...
5
votes
1answer
3k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...