Hot answers tagged vulnerability-scanners
114
You can have some serious fun playing with printers, photocopiers and other such devices - even UPSes. Security is usually an afterthought at best, if not totally absent.
Stuff I've seen:
Default credentials used everywhere, and web-based config panels storing passwords in plaintext, often within a generated config file. I've never seen anything better ...
13
yes there is, it's called metasploit unleashed.
it is an official metasploit wiki with lots of information, it is structured kind of as a tutorial/course and it gets upgraded and updated regularily. it is probably the best place to start.
12
What you are asking to find out is called enumeration.
Reading the SQLMap manual under the enumeration topic provides me with the following information:
--dbs for databases
--tables for tables
--columns for columns
There is also a lot of other good information in the manual, so I suggest reading over it if you have more questions about flags and ...
12
The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.
You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...
11
Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports.
Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...
11
The question is regarding "Security through obscurity"1. Does hiding your design/implementation (e.g. what server you are running) lead to less instances of exploitation? This is a long debated subject with reasonable arguments on both sides of the fence.
All security practices are a tradeoff between cost (e.g. effort, maintainability, money) and benefit ...
10
The major issue here is that your printer is accessible from outside your network. I've never seen a situation where printers need to be accessible from outside a network, and I mean ever! I suggest you get that fixed, and urgently!
There's more to printers than most people realize, but the risks can be managed by keeping them updated, turning off options ...
10
Step one - close all the ports you do not have an explicit business need for!
All open ports add potential insecurity - a closed port is a safe port.
If you don't know why a port is open, I would be worried - find out what service is running on it. If there is no business need, shut it down! If you can't find out what service it is, shut it down!
There ...
9
A core dump, either of the entire system, or single executable, is the entire contents of that processes' memory, or in the case of the system, everything's memory, written out to a file. There can be a lot of data in such a dump - here's an abbreviated form of the memory space of gvim, which I'm currently running:
pmap 19133
19133: gvim fsstate.py
...
9
Other than the user's privacy settings, Facebook doesn't inhibit spiders. My scans show they are not even using a Web Application Firewall to block requests. The load to scrub every HTTP request of the most popular website would be massive undertaking. The problem is that your scanner isn't equipped to interact with a mostly JavaScript client communicating ...
8
Free doesn't go far, but you can try running the following yourself:
The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/
skipfish: http://code.google.com/p/skipfish/
And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...
8
I couldn't agree more with @spinkham's answer. That is the best answer.
To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data
First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work
Powertools to help you ...
8
There are a multitude of ways that people and applications leak information about software versions.
If you can see documents that people post or share, the document format typically explicitly or implicitly identifies the version of software that produced it. People post bug reports and questions on forums asking for help with software.
If you can get ...
8
There's a couple of ways you could do this, that spring to mind
First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type:
use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...
8
If you properly follow the recommendations and standards that you've mentioned here, you should be reasonably safe, as long as you also keep your software up to date. It's arguably more important to install updates for PDF readers, Adobe Flash, Microsoft Office, etc. than the OS updates, because those are where most day-to-day attacks are focused.
A few ...
8
In the strictest sense the safest thing to do is to, of course,
As you've no doubt found this can be difficult in a distributed environment. The specific vulnerability scanning tool you use can also add in some problems. Take Nessus for example. When building a scan profile there is an option called, "Check for PCI-DSS compliance." This makes a bunch of ...
8
That seems to be a NetGear log entry, there are two possibilities for this:
SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...
7
In msf console,
you can use the autocomplete feature (as Rory suggests)
you can use the search command: search windows/fileformat -t exploit
If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/
You can also use things like Armitage to browse exploits in a nicer way or ...
7
Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database.
If that is the case, you may be looking at an issue with an insecure version of ...
7
First of all, there are two main users of memory dumps in security - forensics and exploit writing guys. Pen-testers, not so much - of course it depends on the pentest ;)
The usual way tools that dump memory work is by opening the memory pseudo-device and reading all the contents to a file.
For example with dd in windows you would do something like dd ...
7
In short, yes it would. But you could also use a simple triage approach if threat modelling is too much of an overhead.
In detail -
Code analysis can be a time consuming activity. Even tool lead approaches will generate large amounts of output that will require human review and prioritisation. As such a threat modelling approach can help to identify and ...
7
The "Untrusted code" heuristic is intended to flag the inclusion of any resources that are hosted outside the immediate origin or a pre-defined list of safe origins (https://code.google.com/p/domsnitch/wiki/ConfigFiles#safeOrigins). The basis of this heuristic is to provide a signal if you're including resources from an origin you're not supposed to. It does ...
7
The question cannot be answered (but my bet is on "No way!"): "the Internet" is a transnational entity. So two adjacent IPs might be on the opposite sides of a border, and what is legal (or at least not forbidden by law) for one might be a crime for the other.
In some South European countries chuckle, a portscan can be construed as "suspicious behaviour" -- ...
7
To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes.
As far as security best practices, I have several suggestions:
To avoid XSS, abide by the rules found ...
7
Often printers maintain logs of printed documents, sometimes containing copies of the documents themselves being able to be downloaded remotely. Even if the documents themselves aren't sensitive metadata can sometimes leak information like the file server name, the computer it was sent from, username...
7
Pay for another cheap VPS and install nmap, w3af, etc and any other tools there. Then you SSH in and run your tests. You could also schedule the tests to happen automatically and email the results.
This is not a pre-made service, but it does accomplish what you've asked for with a handful of tiny scripts, done more cheaply and with more control than a paid ...
6
I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above.
Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills.
Port scanning:
Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...
6
Pentesters / "Auditors" should keep a full packet capture of everything their tools put on the wire and this should be available to you as a client. Use this if something does happen to crash, is identified incorrectly, etc. to pinpoint the (mis)behavior of the systems under test.
Also, start basic and manual before assaulting the system with all kinds of ...
Only top voted, non community-wiki answers of a minimum length are eligible
