Tag Info

New answers tagged

1

To help review or design security controls, they can be classified by several criteria, for example according to the time that they act, relative to a security incident: -Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders; -During the event, detective controls ...


3

It is always preventative. Detective controls detect an intrusion in progress. A penetration test is not an intrusion as it is an intended and approved use of the system, even if the use is simulating a breach. It is a preventative measure to keep actual attacks from occurring by finding holes that need to be fixed. The argument could possibly be made ...


0

Yes, it may be a false positive. CVE-2003-0042 was caused when a GET request contained an embedded nul character, and made it possible to list directories that should not be listable and to obtain source code for JSP files. The OpenVAS test for this vulnerability sends a request for the site's home page, and if this does not produce a directory listing, it ...


3

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depend on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


3

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...



Top 50 recent answers are included