Tag Info

Hot answers tagged

32

These types of spurious requests are very, very common. They are either looking to see if you are already compromised, or looking to get your server to throw an error to gather info about your server (from error messages). You aren't the only one: http://shadow.wolvesincalifornia.org/awstats/data/awstats092014.shadow.wolvesincalifornia.org.txt # URL with ...


29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


12

The attacker tries to find out if you have certain premade web software installed by requesting files which are typical for them. When they find out you use, say, wordpress or phpbb or mediawiki, they can then try to use exploits specific to these applications to take over your site. The best countermeasure against this is to avoid installing too much ...


11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed. Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...


10

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.


10

It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION. The correct question should be "What techniques are available to asses the security of a web application, how are they commonly implemented, and how do you keep up on the latest improvements to both the techniques and their implementations?" For example, better tools are ...


10

Yes, those are scans. If you Google those strings you will see that they show up in the web logs of numerous sites throughout the Internet, usually cheap webhost sites which put their logs up where Google can see them. This is sufficient indication that some tool is trolling for that URL. There is not enough information to indicate what the scan is ...


7

If you don't have permission to perform security testing against a target, don't do it. In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat ...


7

They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain. When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the ...


6

Why don't you give Arachni a try. It's written in ruby and it seems to be very promising.


6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.


6

And theres also OWASP Zed Attack Proxy: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project To quote from the home page: "The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ...


6

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


6

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


5

I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well. I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise. Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the ...


5

Have a look at the OWASP Top 10 Project. OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there. In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon. As far as tools go - ...


5

You can do some automated scans with OWASP ZAP or Burp (Burp isn't free).


5

The problem is with the browser (or in the case of the linked CVE with Outlook). The attack is as follows: I create a file and send this file to the program with the MIME type image/png. The browser ignores the MIME type and sniffs the content of the file (even I explicitly say that the file is of type image/png). The browser determines (from sniffing) ...


4

There's also OWASP WebScarab and Paros. However, this page contains a list that should have what you want.


4

The OWASP organization is a not-for-profit worldwide charitable organization focused on improving the security of application software and has some nice tools to help detect vulnerabilities and protect applications.


4

You need to configure w3af not to spider the logout link.


4

Reliably detecting Cross-Site Scripting is a relatively complex task, just inserting a string with no control characters and looking for it in the response, is a very bad idea as you'll be swamped by false positives. What most scanners to is take a series of standard vectors (e.g. ">< script >alert(1)< /script ><") and then look at the response ...


4

The Web Application Security Consortium webpage listed below contains a number of different tools for different roles. http://projects.webappsec.org/w/page/13246988/Web-Application-Security-Scanner-List Some of the tools that I use on a regular basis are: AppScan and WebInspect: automated analysis tools, powerful for automating certain types of checks but ...


4

Nessus really bad for web application fuzzing. The open source world can offer Wapiti, Skipfish and w3af(kind of broken). Acunetix is a good commercial product at a reasonable price. NTOSpider is one of the web application fuzzing tools, but it costs $10,000+ and your first born. Sitewatch has a free service thats worth checking out.


4

There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another. There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...



Only top voted, non community-wiki answers of a minimum length are eligible