Tag Info

Hot answers tagged

29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed. Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...


10

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.


10

It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION. The correct question should be "What techniques are available to asses the security of a web application, how are they commonly implemented, and how do you keep up on the latest improvements to both the techniques and their implementations?" For example, better tools are ...


7

If you don't have permission to perform security testing against a target, don't do it. In the US, you are definitely at risk of falling foul of the The Computer Fraud and Abuse Act 1986, 1994, 1996 and possibly other acts. It's easy enough to set up a test target of your own, ask a friend for permission to test their site, or use a service such as Webgoat ...


7

They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain. When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the ...


6

Why don't you give Arachni a try. It's written in ruby and it seems to be very promising.


6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.


6

And theres also OWASP Zed Attack Proxy: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project To quote from the home page: "The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ...


6

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


6

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


5

I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well. I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise. Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the ...


5

Have a look at the OWASP Top 10 Project. OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there. In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon. As far as tools go - ...


5

The problem is with the browser (or in the case of the linked CVE with Outlook). The attack is as follows: I create a file and send this file to the program with the MIME type image/png. The browser ignores the MIME type and sniffs the content of the file (even I explicitly say that the file is of type image/png). The browser determines (from sniffing) ...


4

Nessus really bad for web application fuzzing. The open source world can offer Wapiti, Skipfish and w3af(kind of broken). Acunetix is a good commercial product at a reasonable price. NTOSpider is one of the web application fuzzing tools, but it costs $10,000+ and your first born. Sitewatch has a free service thats worth checking out.


4

There's also OWASP WebScarab and Paros. However, this page contains a list that should have what you want.


4

You need to configure w3af not to spider the logout link.


4

Reliably detecting Cross-Site Scripting is a relatively complex task, just inserting a string with no control characters and looking for it in the response, is a very bad idea as you'll be swamped by false positives. What most scanners to is take a series of standard vectors (e.g. ">< script >alert(1)< /script ><") and then look at the response ...


4

The OWASP organization is a not-for-profit worldwide charitable organization focused on improving the security of application software and has some nice tools to help detect vulnerabilities and protect applications.


4

The Web Application Security Consortium webpage listed below contains a number of different tools for different roles. http://projects.webappsec.org/w/page/13246988/Web-Application-Security-Scanner-List Some of the tools that I use on a regular basis are: AppScan and WebInspect: automated analysis tools, powerful for automating certain types of checks but ...


4

There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another. There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...


4

You can do some automated scans with OWASP ZAP or Burp (Burp isn't free).


4

In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list: Is networking limited to protocols required for business purposes with no ...


3

Fail2ban has an example script for doing this from Apache log files. Basically look for the PHPMyAdmin string in your logs with a 404.


3

WebDAV is more of a configuration nightmare than anything. If it's misconfigured it can lead to a whole host of vulnerabilities like being able to access application files, directory traversal, bypassing authentication, etc. If you aren't using it, the default settings are apparently reasonably safe, based on the IIS security model. If you ARE using it, ...



Only top voted, non community-wiki answers of a minimum length are eligible