Tag Info

New answers tagged

0

I really dont understand the point. What do you gain from hacking sites with no value whatsoever, as oppose to targeting a specific site, and then trying? Try acunetix, I believe that can scan multiple targets. If you can't find one, then why not write one yourself in a language you like?


0

did you try sqlmap? just do a simple google search for CLI linux sqli tools and write your own bash/python/ruby/whatever script to loop throw the list of domains and to output the result to a database.. hope this give you ideas.. there are many.


3

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depend on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


3

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...


1

That seems to be just whatever memory they grabbed via heartbleed. It looks like a PHP script executing wget, which was probably in the memory of the server being scanned.


0

For Linux, disable root if you don't need it. Use sudo with a properly configured sudoers file. This allows fine-grained control over what users have what superuser permissions (i.e. you can allow sudo only for Nessus). Alternatively, you can set permissions so the account running Nessus has permissions to access the resources it needs (this will be more ...


0

oh you're so close, it's ./sqlmap.py -u http://example.com --tables



Top 50 recent answers are included