Tag Info

Hot answers tagged

29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed. Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...


10

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.


10

It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION. The correct question should be "What techniques are available to asses the security of a web application, how are they commonly implemented, and how do you keep up on the latest improvements to both the techniques and their implementations?" For example, better tools are ...


7

They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain. When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the ...


6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.


6

And theres also OWASP Zed Attack Proxy: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project To quote from the home page: "The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ...


6

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


6

If you don't have permission to perform security testing against a target, don't do it. In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat ...


5

I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well. I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise. Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the ...


5

Have a look at the OWASP Top 10 Project. OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there. In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon. As far as tools go - ...


5

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


4

There's also OWASP WebScarab and Paros. However, this page contains a list that should have what you want.


4

The Web Application Security Consortium webpage listed below contains a number of different tools for different roles. http://projects.webappsec.org/w/page/13246988/Web-Application-Security-Scanner-List Some of the tools that I use on a regular basis are: AppScan and WebInspect: automated analysis tools, powerful for automating certain types of checks but ...


4

The OWASP organization is a not-for-profit worldwide charitable organization focused on improving the security of application software and has some nice tools to help detect vulnerabilities and protect applications.


4

Nessus really bad for web application fuzzing. The open source world can offer Wapiti, Skipfish and w3af(kind of broken). Acunetix is a good commercial product at a reasonable price. NTOSpider is one of the web application fuzzing tools, but it costs $10,000+ and your first born. Sitewatch has a free service thats worth checking out.


4

There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another. There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...


4

In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list: Is networking limited to protocols required for business purposes with no ...


4

Reliably detecting Cross-Site Scripting is a relatively complex task, just inserting a string with no control characters and looking for it in the response, is a very bad idea as you'll be swamped by false positives. What most scanners to is take a series of standard vectors (e.g. ">< script >alert(1)< /script ><") and then look at the response ...


4

The problem is with the browser (or in the case of the linked CVE with Outlook). The attack is as follows: I create a file and send this file to the program with the MIME type image/png. The browser ignores the MIME type and sniffs the content of the file (even I explicitly say that the file is of type image/png). The browser determines (from sniffing) ...


3

"Javascript Obfuscation" is where your site is vulnerable to having obfuscated javascript run because your filters do not account for it. This does not mean that you have a problem, just that there is a possibility of a problem. Look at OWASP for libraries that you can use to combat this problem. "Blackhole" is a resulting infection from Javascript ...


3

Some of the services offered (not especially by McAfee, but in general in this area): checking the site is up confirming the DNS records are correct scanning email in and outbound running your intrusion detection service checking for spoof/malicious versions hosted elsewhere checking for brand theft checking your versions of OS/app etc against new ...


3

Usually when exploiting logins you want to inject something that prevents the password field from ever validating. This can usually be accomplished by putting syntax similar to the following as your password: myphonypassword' OR 1=1;-- This will claim that you are the admin user, terminate the string in the actual query and make the query don't care if ...


3

Try: http://www.morningstarsecurity.com/research/whatweb WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 ...


3

WebDAV is more of a configuration nightmare than anything. If it's misconfigured it can lead to a whole host of vulnerabilities like being able to access application files, directory traversal, bypassing authentication, etc. If you aren't using it, the default settings are apparently reasonably safe, based on the IIS security model. If you ARE using it, ...


3

Troy, I've seen your work, including the Netsparker integration with TeamCity. I commented and mentioned Burp Suite Professional in headless mode might be more appropriate, but fully automated testing in this way only finds a few of the bugs. It's a classic test automation problem. However, if you do have known HTTP requests that produce a non-desired ...


3

In my opinion, the main problem when a pentester faces a web application that uses clean URLs is to identify which parts of the URL are resources and which parts are parameters because usually parameters are what we test more deeply. In this case, I think that the best option is to test all parts of the URLs assuming all parts are parameters: ...


2

My favorite tool for PCI DSS audits/assessments in terms of web application is Fiddler (or FiddlerCap). You can give either of these tools to a newbie or grandma and they will be able to figure it out with little instruction. You have them send you a SAZ file (or FiddlerCap file), which involves them using the save dialog after using Internet Explorer to ...



Only top voted, non community-wiki answers of a minimum length are eligible