Tag Info

Hot answers tagged

3

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...


2

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depends on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


1

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...



Only top voted, non community-wiki answers of a minimum length are eligible