Tag Info

Hot answers tagged

4

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...


3

It is best to plan out and control each URI (params or not) sent to the active/passive scanning engine. The target analyzer in the engagement tools (typically selected from the Target sitemap tab as "Analyze target") is a great place to select parameters and then "send to Intruder". Typically, you can customize your fault injection strategies in Intruder by ...


3

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depend on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


3

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...


2

No. The number of pages Google (and any major search bot) is willing to crawl on your domain (or indeed whether they are willing to crawl it at all) is based on how relevant they think your domain is. There are plenty of sites with an infinite number of pages. This problem was solved decades ago.


2

Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to access the site, regardless of the domain name used. This is true with both Apache and nginx. From the Apache Wiki: As a rule, it is impossible to host ...


2

Nessus has the information posted on their page with a full walk through. http://www.tenable.com/tips/how-to-enable-credentialed-checks-on-windows


2

The first line is a HTTP response splitting attack, %0d%0a is a CRLF, it is trying to generate 2 responses for the same request: http://en.wikipedia.org/wiki/HTTP_response_splitting The second line is a path traversal attack like people already mentioned. The characters there are unicode representations of backslash that would make an attack succesful is ...


2

It's probably either a crawler or internet background noise (e.g. automated vulnerability scanners). If all those pages actually exist it's a crawler, if not it's a internet background noise. If it annoys you, you can ban the IP on your firewall. Another option is a Host Based Intrusion Detection system like OSSEC which detects these type of attacks and ...


2

These requests are caused by Adware:Win32/Adpeak malfunctioning (yeah, believe it or not, even malware can malfunction). It sets up a proxy server on the infected systems that injects script tags in all HTML content that passes through it, similar to <script type="text/javascript" id="2f2a695a6afce2c2d833c706cd677a8e" ...


1

You can detect the use of known bad dependencies with OWASP Dependency-Check I found this also looking for tools which attempt to exploit the known issues repetitively. It's looking like I may have to modify existing active vulnerability scanners.


1

Short version : there is no central / unique command to check this by default on linux .. but you could rely on several tools, depending on the kind of scanning that you would like to find : Fail2ban to parse log file (ssh server, web server, ftp, vpn, etc.) in order to find any brute force / irregular login attempt (and trigger some firewall rules) On ...


1

If you are trying to catalog all possible attack inputs, creating a list of all form input fields would be incomplete and could lead you to having a false sense of security. There are many other potential origins of attack (parameters in the URL is a very common one). One thing that helped me when I began looking at website security was to start viewing it ...


1

Nessus 5 made a change: It's in the Preferences section: Login configurations HTTP login page There you can set your HTTP credentials/settings. This is a basic check in the documentation. Why go Google, when you can RTFM....


1

If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/1.1 requires a Host header but also most HTTP/1.0 clients already send one. Blocking these clients can be done with: if ( $http_host = '' ) { ...


1

The ZAP reporting could definitely do with some improvements. However you can access all of the alerts via the ZAP API in JSON and XML format. If you enable the API (via the options) you can then access a URL like: http://zap/JSON/core/view/alerts/?baseurl=http%3A%2F%2Fwww.example.com%2F&start=&count= to get all of the alerts reported on ...


1

Even without special engineering, certain site architectures can have long recursive paths - certain wikis, for instance. Any decently written bot should be able to cope with such site behaviour, at the very least having a recursion depth limit. I don't think anyone here is going to be able to answer concretely, since none of us have access to google's ...



Only top voted, non community-wiki answers of a minimum length are eligible