A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

0
votes
3answers
40 views

Local network proxy/spoof

Are intruders in a local network able to mask their local IP in any way? Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
3answers
44 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
1answer
54 views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a wordpress site ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that ...
1
vote
2answers
103 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
1
vote
3answers
133 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
1
vote
0answers
28 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
5
votes
3answers
279 views

Failed PCI-DSS Compliance | Submitting Evidence

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
1
vote
0answers
29 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
2answers
106 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
0
votes
2answers
412 views

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would ...
1
vote
0answers
88 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
2
votes
2answers
270 views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
1
vote
2answers
116 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
7
votes
1answer
217 views

How do vulnerability scanners detect when DEBUG is set to True on ASP.NET applications

I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this. I've ...
-2
votes
2answers
870 views

What are the limitations of vulnerability scanners?

What are the limitations of vulnerability scanners? If it is related to how these scanners work, how these work?
8
votes
1answer
2k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
3
votes
1answer
69 views

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
0
votes
1answer
605 views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
154 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
249 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
98 views

Organizing scheduled vulnerability scans

I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
0
votes
1answer
229 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
2
votes
1answer
116 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
0
votes
2answers
309 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
2
votes
5answers
294 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
2
votes
2answers
967 views

Why Nessus freezes at 0% and how to fix it?

Does anybody know why Nessus freezes at 0%? I am not sure that I've done the right configuration, but it is becoming painful How long approximately takes to scan one machine?
1
vote
3answers
269 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
10
votes
2answers
391 views

How can a network observer identify computers running old versions of Java?

I received an email earlier today from my ISP (a university). The email reads (in part): Your network connection has been disabled because your version of Java is not patched for the most recent ...
-2
votes
1answer
87 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
8
votes
1answer
1k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
6
votes
1answer
242 views

Is it dangerous “Powered by…” tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
9
votes
5answers
2k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
10
votes
4answers
361 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
2
votes
1answer
623 views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
10
votes
2answers
391 views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
11
votes
3answers
953 views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
4
votes
1answer
110 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
0
votes
1answer
446 views

how to access to arachni scanner web interface? [closed]

I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner. I run it but no web page appears. I just see these lines: ...
-1
votes
2answers
166 views

How do you search for new vulnerabilities? [closed]

I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
1
vote
1answer
78 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
-2
votes
1answer
103 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
4
votes
1answer
392 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
2
votes
3answers
3k views

How to use information from GHDB and FSDB (Google-Dorks)?

I am new to information security and analysis. Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool. What are ...
3
votes
1answer
140 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
1
vote
1answer
677 views

Pre Installed OpenVAS , light way Linux [closed]

Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ? I have used Back Track (UBUNTU ...
7
votes
2answers
5k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
-6
votes
1answer
815 views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com
3
votes
2answers
109 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
3
votes
3answers
2k views

Besides OpenVas and Nessus, what are my other options for vulnerability detection?

I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like). I use Linux so do I have any other options for vulnerability detection?
3
votes
1answer
128 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...