A web application security scanner performs a black box test on a web application to identify potential security vulnerabilities and architectural weaknesses in the web application.

learn more… | top users | synonyms

2
votes
2answers
847 views

Looking for open source crawler/spider & scanner [closed]

Until now I managed to look into Webscarab, Webscarab-NG, IronWASP & Burp extender. Unfortunately, except IronWASP, that refused to compile from the GIT source, none of the projects matched my ...
1
vote
3answers
3k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
1
vote
2answers
633 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
5
votes
2answers
2k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
1answer
224 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
2
votes
3answers
7k views

How to exploit this SQL injection vulnerability?

I am learning SQL injection on a vulnerable web app. I scanned it with w3af. It showed many vulnerabilities. One of them is: SQL injection in a Microsoft SQL database was found at: ...
5
votes
2answers
3k views

Preventing Attacks Scanning for PHPMyAdmin etc

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this: 190.196.161.110 - - ...
4
votes
1answer
181 views

Services Like McAfee Secure

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
4
votes
2answers
203 views

Scan for common web applications?

Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and ...
18
votes
5answers
4k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
5
votes
1answer
3k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
15
votes
3answers
636 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
3
votes
2answers
3k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...