New answers tagged

1

There is an application called "OpenDLP" (data loss prevention) that can be used to scour your network for sensitive data. It is based on regexs so you could configure it to search for whatever you'd like: Passwords, keywords in intellectual property, social security numbers, credit cards. This would definitely help minimize the occurrences of data leakage. ...


2

The important files vary by programming language, and environment. For example, if you're running nginx, .htaccess files, by default, won't affect the behaviour of the server. However, those same files could really mess things up if someone loaded your application into an Apache environment. Therefore, you need to customise any list to your own needs. There ...


1

Whenever we submit an offer for a penetration test we are facing the same question: How complex is the application? Complexity leads to additional attack surface, which leads to a lot of tests, which might lead to a lot of findings which require a lot of documentation. This effort has to be reflected within the offering. To determine the possible complexity ...


0

It sounds like you're looking for an ASV solution and each of these will scan and identify vulnerabilities using the same vulnerability databases and ranking methodologies. The main differentiators are generally cost, ease of use and reporting functionality.


0

The free book from O'Reilly on DevOpsSec: Securing Software through Continuous Delivery notes that a vulnerability management solution should create directives for configuration-management tools (including Ansible, Chef, Puppet, Salt, Powershell DSC, and Docker). This may preclude the three vendors you suggested, so I suggest looking at other solutions.


0

Fuzzing is a form of vulnerability testing. But vulnerability testing is not necessary a form of fuzzing. Some vulnerability scanners might use fuzzing techniques, modules or plugins to do so. For example Nessus has the following plugins to approach "unknown" issues in web applications (source): 44967: CGI Generic Command Execution Vulnerability (time ...


1

This is an interesting question. Font files are like other media files which might be abused by malware or within exploiting attempts. Detecting malicious blocks in such media files would follow a signature-based approach: You or your antivirus software would be looking for suspicious pattern. I'm not aware of a public compilation of malicious code in font ...


4

The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. In the case of web applications: injections and so on. It is possible that a vulnerability scanner can include some sort of fuzzing as one of the tests it ...


4

It's a false positive. In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is: root:function(a){return a===o} This is obviously not from a passwd file. It is also very unlikely that any server-side vulnerability exists in a request for a jQuery file, generally they are static files that are ...


3

No, JQuery is a client-side technology, which is really a wrapper for JavaScript for use within a web-browser only JavaScript doesn't have the capability to run OS commands when invoked by a browser, unless security settings are lowered within Internet Explorer. And JQuery cannot provide any additional functionality that circumvents this. This appears to ...



Top 50 recent answers are included