Tag Info

Hot answers tagged

3

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depend on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


3

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...


2

No. The number of pages Google (and any major search bot) is willing to crawl on your domain (or indeed whether they are willing to crawl it at all) is based on how relevant they think your domain is. There are plenty of sites with an infinite number of pages. This problem was solved decades ago.


2

Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to access the site, regardless of the domain name used. This is true with both Apache and nginx. From the Apache Wiki: As a rule, it is impossible to host ...


2

Nessus has the information posted on their page with a full walk through. http://www.tenable.com/tips/how-to-enable-credentialed-checks-on-windows


2

The first line is a HTTP response splitting attack, %0d%0a is a CRLF, it is trying to generate 2 responses for the same request: http://en.wikipedia.org/wiki/HTTP_response_splitting The second line is a path traversal attack like people already mentioned. The characters there are unicode representations of backslash that would make an attack succesful is ...


2

It's probably either a crawler or internet background noise (e.g. automated vulnerability scanners). If all those pages actually exist it's a crawler, if not it's a internet background noise. If it annoys you, you can ban the IP on your firewall. Another option is a Host Based Intrusion Detection system like OSSEC which detects these type of attacks and ...


1

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...


1

Nessus 5 made a change: It's in the Preferences section: Login configurations HTTP login page There you can set your HTTP credentials/settings. This is a basic check in the documentation. Why go Google, when you can RTFM....


1

If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/1.1 requires a Host header but also most HTTP/1.0 clients already send one. Blocking these clients can be done with: if ( $http_host = '' ) { ...


1

The ZAP reporting could definitely do with some improvements. However you can access all of the alerts via the ZAP API in JSON and XML format. If you enable the API (via the options) you can then access a URL like: http://zap/JSON/core/view/alerts/?baseurl=http%3A%2F%2Fwww.example.com%2F&start=&count= to get all of the alerts reported on ...


1

Even without special engineering, certain site architectures can have long recursive paths - certain wikis, for instance. Any decently written bot should be able to cope with such site behaviour, at the very least having a recursion depth limit. I don't think anyone here is going to be able to answer concretely, since none of us have access to google's ...



Only top voted, non community-wiki answers of a minimum length are eligible