Hot answers tagged web-scanners
29
there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools.
On top of that there's a huge range of scripts and point ...
15
My preferred tool bag to do a black box web app pen. test is currently:
BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application"
Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...
14
Along with advice on how to use Burp, you should also not forget to customise the following:
Form Submission:
To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-)
Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...
11
Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed.
Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...
10
It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION.
The correct question should be "What techniques are available to asses the security of a web application, how are they commonly implemented, and how do you keep up on the latest improvements to both the techniques and their implementations?"
For example, better tools are ...
9
If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.
6
And theres also OWASP Zed Attack Proxy: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
To quote from the home page:
"The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
It is designed to be used by people with a wide range of security experience and as such is ...
6
Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite.
Note that the Second Edition is now available.
6
One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.
6
If you don't have permission to perform security testing against a target, don't do it.
In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat ...
5
I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well.
I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise.
Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the ...
5
Have a look at the OWASP Top 10 Project.
OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.
In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.
As far as tools go - ...
4
There's also OWASP WebScarab and Paros.
However, this page contains a list that should have what you want.
4
The Web Application Security Consortium webpage listed below contains a number of different tools for different roles.
http://projects.webappsec.org/w/page/13246988/Web-Application-Security-Scanner-List
Some of the tools that I use on a regular basis are:
AppScan and WebInspect: automated analysis tools, powerful for automating certain types of checks but ...
4
The OWASP organization is a not-for-profit worldwide charitable organization focused on improving the security of application software and has some nice tools to help detect vulnerabilities and protect applications.
4
Nessus really bad for web application fuzzing. The open source world can offer Wapiti, Skipfish and w3af(kind of broken). Acunetix is a good commercial product at a reasonable price. NTOSpider is one of the web application fuzzing tools, but it costs $10,000+ and your first born. Sitewatch has a free service thats worth checking out.
3
"Javascript Obfuscation" is where your site is vulnerable to having obfuscated javascript run because your filters do not account for it. This does not mean that you have a problem, just that there is a possibility of a problem. Look at OWASP for libraries that you can use to combat this problem.
"Blackhole" is a resulting infection from Javascript ...
3
Some of the services offered (not especially by McAfee, but in general in this area):
checking the site is up
confirming the DNS records are correct
scanning email in and outbound
running your intrusion detection service
checking for spoof/malicious versions hosted elsewhere
checking for brand theft
checking your versions of OS/app etc against new ...
3
Usually when exploiting logins you want to inject something that prevents the password field from ever validating. This can usually be accomplished by putting syntax similar to the following as your password:
myphonypassword' OR 1=1;--
This will claim that you are the admin user, terminate the string in the actual query and make the query don't care if ...
3
WebDAV is more of a configuration nightmare than anything. If it's misconfigured it can lead to a whole host of vulnerabilities like being able to access application files, directory traversal, bypassing authentication, etc.
If you aren't using it, the default settings are apparently reasonably safe, based on the IIS security model. If you ARE using it, ...
3
There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another.
There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...
3
In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:
Is networking limited to protocols required for business purposes with no ...
2
My favorite tool for PCI DSS audits/assessments in terms of web application is Fiddler (or FiddlerCap). You can give either of these tools to a newbie or grandma and they will be able to figure it out with little instruction.
You have them send you a SAZ file (or FiddlerCap file), which involves them using the save dialog after using Internet Explorer to ...
2
Since no one has mentioned it, insecure.orgs's sectools.org list is a great starting point for application resources in general, especially for who are relatively new to being actively involved in network-related IT security. If you haven't checked it out, I would absolutely recommend looking over their Top 100 list to familiarize yourself with some of the ...
2
Try: http://www.morningstarsecurity.com/research/whatweb
WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 ...
2
Troy,
I've seen your work, including the Netsparker integration with TeamCity. I commented and mentioned Burp Suite Professional in headless mode might be more appropriate, but fully automated testing in this way only finds a few of the bugs. It's a classic test automation problem.
However, if you do have known HTTP requests that produce a non-desired ...
2
You need to make a POST to the URL http://www.example.com/Login.aspx?CurrentPage=Login. The exploit is in the data submitted in the body of the POST, something like ...ctl00$cphMain$txtUserName=d'z"0... -- and the ' makes it look like txtUserName is the field you want to attack. The standard way to separate fields is with a & character, but the fragment ...
2
SecToolAddict has a very in-depth review of many commercial, free, open, and closed source scanners. You will find many high quality options there. His new round of tests are starting soon.
From my personal experience, I can vouch for w3af and arachni as having spiders and being effective scanners. Both of them are open-source, under active development, and ...
2
Wapiti (python) and Skipfish (C/C++) are both good open source scanners that are not bad. My biggest complaint is that they are overly simplistic, for instance Skipfish doesn't actually have an html parser, instead it uses a system of overly simplistic regular expressions. Wapiti uses Python's html parser, which is better, however Wapiti isn't ...
2
Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers.
For example, a common open source vulnerability scanner skipfish has flags to mimic ...
Only top voted, non community-wiki answers of a minimum length are eligible
