Hot answers tagged web-scanners
11
Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed.
Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...
5
Have a look at the OWASP Top 10 Project.
OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.
In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.
As far as tools go - ...
3
In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:
Is networking limited to protocols required for business purposes with no ...
3
There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another.
There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...
2
Not sure what you're finding because your question lacks detail, but it looks like you have the audit.generic plugin enabled and you're actually seeing something like: "Possible unidentified vulnerability" or "Unidentified vulnerability".
If this is the case, what w3af is telling you is that you should look into those HTTP requests and responses because ...
2
Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers.
For example, a common open source vulnerability scanner skipfish has flags to mimic ...
2
SecToolAddict has a very in-depth review of many commercial, free, open, and closed source scanners. You will find many high quality options there. His new round of tests are starting soon.
From my personal experience, I can vouch for w3af and arachni as having spiders and being effective scanners. Both of them are open-source, under active development, and ...
2
Wapiti (python) and Skipfish (C/C++) are both good open source scanners that are not bad. My biggest complaint is that they are overly simplistic, for instance Skipfish doesn't actually have an html parser, instead it uses a system of overly simplistic regular expressions. Wapiti uses Python's html parser, which is better, however Wapiti isn't ...
2
You can suspend the process and resume it after a while. The OS buffers data that is being sent to a suspended server and the server will receive it after it is resumed.
For Linux:
pkill -stop <process-name>
sleep <seconds>
pkill -cont <process-name>
For Windows there is PsSuspend:
pssuspend <process name>
ping -w 500 -n ...
2
There may be software out there that could introduce packet delays, however there are considerations against using that:
introducing packet delays may interfere with OS or application fingerprinting. Fingerprinting measures responses, introducing delay may skew your results
Delaying packets cause resource contention. If you tell your scanner to do a /24 ...
2
In my opinion, the main problem when a pentester faces a web application that uses clean URLs is to identify which parts of the URL are resources and which parts are parameters because usually parameters are what we test more deeply.
In this case, I think that the best option is to test all parts of the URLs assuming all parts are parameters:
...
2
As Terry suggested OWASP is the first place anyone should start off especially w.r.t. Web App Security. In addition to that, I would suggest you to also look into WASCv2 and SANS CWE Top 25.
1
Why would you be testing CPanel for PCI compliance? How did you come to arrive at C-VT as the applicable SAQ?
Which PCI requirement is this being done to meet?
One thing is for sure: CPanel should NEVER be exposed to the open Internet. So if you are scanning it from over the net you can forget PCI compliance.
I do PCI for a living.
1
I'm not sure what a self-test is, however you don't need to pay anything for tools in order to test against the PCI standards. There are loads of free tools out there, there are even security and forensics specific OS distros out there that cost absolutely nothing. So get a copy of the Backtrack or Kali OS distro and run it off a USB or as a virtual machine ...
1
General knowledge about how applications work and how to introduce atypical or unexpected behavior into the application that might pose a security threat. Please refer to the OWASP testing guide. https://www.owasp.org/index.php/OWASP_Testing_Project
Depends, there are a lot of tools like Zap, Burp, BackTrack and of course homebrew scripts.
That entirely ...
1
If you decide to use ZAP (and obviously I hope you do;) then please consider feeding any customizations you need to make back into ZAP.
ZAP is a community project - we try to encourage as many people as possible to get involved.
And if you submit some good quality code then we'll give you commit access :)
We also have a very active developer group, so if ...
1
Clean URLs can be implemented differently and therefore depends on what system is used.
For example with rewrite rules in the webserver:
url.rewrite-final = (
"^/system/test/(.*)$" => "/index.php?q=system/test/$1",
"^/([^.?]*)\?(.*)$" => "/index.php?q=$1&$2",
"^/([^.?]*)$" => "/index.php?q=$1",
"^/rss.xml" => "/index.php?q=rss.xml"
...
1
You can do this with tc traffic control on Linux, you can manipulate latency, jitter, packet loss/duplication/corruption and bandwidth. I have found it useful to determine how robust certain connection are, amongst other things.
Since this is done within the OS network stack it will be more effective than any userspace solution.
FreeBSD has pf which offers ...
1
You cannot introduce delays in a generic way without (potentially) breaking functionality, because some / most of scanning is subject to timeouts. When a tool wants to know if port X is open on host Y, it sends a packet which targets that port; if it does not receive a response within a given time T, then it decides that the port is "closed". The timeout ...
1
Interesting, just read the background. I assure you has nothing to do with drumming up business. We have no need to do that. If you send us your info at info@sucuri.net we'll see if we can't better understand what is going on.
The 404testpage is a test page we emulate to see output of a page when we can't pinpoint the issue but we can see the payload.
I ...
Only top voted, non community-wiki answers of a minimum length are eligible
