A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
85
votes
8answers
4k views
Attacking an office printer?
I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
15
votes
4answers
1k views
Open-source penetration-test automation
Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?
Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
12
votes
2answers
504 views
How can I test my web application for timing attacks?
race conditions, etc.
Are there automatic tools for this? What manual techniques should I use?
From the Area51 proposal
9
votes
4answers
3k views
Browsing exploits with Metasploit console
Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
9
votes
4answers
967 views
How does System Memory Dump work?
So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
9
votes
3answers
920 views
Can anyone suggest good open source tools for scanning source code for vulnerabilities?
I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
8
votes
3answers
295 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
8
votes
6answers
889 views
Whats the probability of a personal computer being hacked?
For a normal computer user following these practices:
Have an up to date anti-virus with a firewall installed (Norton).
Do not install cracked software.
Do not open suspicious links or download ...
8
votes
3answers
156 views
would threat modeling help in scanning code?
threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
8
votes
3answers
227 views
Building list of vulnerabilities that should be verified during pentest
I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices.
People often mention that it is a good idea to gather intelligence and enumerate ...
8
votes
2answers
151 views
Any tool for scanning vulnerabilities in browser extensions?
I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
7
votes
3answers
396 views
Which resources can help me learn how to use metasploit?
I tried google search but I can't find good resources to learn how to use the metasploit framework.
Where would you suggest a beginner go to learn about using metasploit?
7
votes
2answers
8k views
nmap scan shows ports are filtered but nessus scan shows no result
I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered
When I perform a nessus scan on the ...
7
votes
4answers
666 views
How to validate if a JavaScript library is secure?
I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
7
votes
1answer
307 views
How can I stop this DOS attack?
I have this entry appearing constantly in my router logs:
[DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx]
They just never stop. It doesn't seem to affect ...
7
votes
3answers
174 views
How do I test and secure ASN.1 Parsers?
As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
7
votes
1answer
379 views
What evaluation criteria would you use for an Oracle scanning tool?
What evaluation criteria would you use to select the right Oracle scanning tool?
Context:
To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
6
votes
8answers
592 views
What is the vulnerability in my PHP code?
A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam.
I've taken ...
6
votes
2answers
473 views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
5
votes
6answers
396 views
Determining vulnerable software on client machines
I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
5
votes
3answers
212 views
Is “untrusted code” reported by DOM Snitch a vulnerability?
One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool:
Is it a vulnerability?
Edit: This report of ...
5
votes
1answer
3k views
Testing SQL injection using sqlmap
I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks.
I got a website which is vulnerable:
C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
5
votes
2answers
156 views
What should a Vulnerability Management System scan on a large scale
On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?
I ...
5
votes
1answer
570 views
How to Perform Vulnerability Assessment for WCF services
Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
5
votes
1answer
2k views
Does WebDAV pose an unreasonable risk in IIS7.5?
I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
4
votes
3answers
553 views
How to figure out which open ports or services are insecure?
We have around one thousand machines on internet. We do port scanning with nmap, and find many ports open on these machines. Sometime we found administrative website using HTTP instead of HTTPS, we ...
4
votes
1answer
100 views
Nessus HTML5 version 5.0.3 - PCI Scan
I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
4
votes
2answers
515 views
Network Vulnerability Scanner placement on network
We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard.
Qualys supply a scanner appliance for the internal network scanning, which ...
4
votes
3answers
172 views
Failed PCI-DSS Compliance | Submitting Evidence
One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
4
votes
1answer
343 views
How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?
On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error.
It's rather frustrating that these ...
4
votes
2answers
1k views
Command line Nessus/OpenVAS or NSE to find specific vulns?
Which methods do you use to quickly scan a network for certain vulnerabilities?
I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
3
votes
3answers
1k views
Besides OpenVas and Nessus, what are my other options for vulnerability detection?
I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like).
I use Linux so do I have any other options for vulnerability detection?
3
votes
4answers
945 views
Problems during Pen-testing of SCADA systems
Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
3
votes
2answers
582 views
Is SNMPing available anymore?
I am researching SNMP and I read about a scanning tool from SANS called SNMPing. Is this tool still available?
I cannot find anywhere to download it. Sending an empty email to snmptool@sans.org just ...
3
votes
1answer
203 views
Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals.
The company has thousands of retail points all around the world which need to be ...
3
votes
2answers
257 views
How realistic and possible is this sort of attack
I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me.
Nessus rated this finding's risk as Medium. The finding was, that a service ...
3
votes
5answers
126 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
3
votes
2answers
267 views
Tools for analyzing Perl 5 code?
I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
3
votes
1answer
118 views
Suddenly scans for 'formvars.php'
Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file:
/somerealpath/includes/formvars.php
I'm ...
3
votes
2answers
864 views
Scanning DVWA with w3af - Unable to detect SQLi when security on low
I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
3
votes
1answer
87 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
3
votes
2answers
70 views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
2
votes
3answers
485 views
How does Facebook avoid crawling over their site?
I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
2answers
178 views
unix config scanner / compliance checks
I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds
PermitRootLogin yes
in the ssh config file or with other words: a script that automates ...
2
votes
2answers
310 views
Why Nessus freezes at 0% and how to fix it
Does anybody know why Nessus freezes at 0%.
I am not sure that I've done the right configuration, but it is becoming painful
How long approximately takes to scan one machine?
Thank you
2
votes
3answers
853 views
Open Source Vulnerability Scanner
I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
3answers
662 views
How to use information from GHDB and FSDB (Google-Dorks)?
I am new to information security and analysis.
Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool.
What are ...
2
votes
1answer
269 views
Can fuzzing be considered a software testing technique for any vulnerability type
I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar
...
2
votes
1answer
364 views
Good software for IT Infrastructure discovery
Currently, I have an industry attachment project in which my group need to suggest a good tool for Network discovery to a IT service company. The company wants to automate the stage in which they have ...
