Tag Info

New answers tagged

1

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depends on both App and Scanner. If your app has DROP and UPDATE queries, in case of Injection, you may lost the data even SELECT query is sent by scanner. In some SQL Exploitation tools like ...


2

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page and it returns a cookie without the 'secure' flag that is essentially a passive test. But if the scanner is trying to find an XSS vulnerability in a parameter ...


1

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...


0

makes me remember this: char shellcode[] = "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00" "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff" "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3"; void main() { int *ret; ret = (int *)&ret + 2; ...



Top 50 recent answers are included