New answers tagged

1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list -...


2

Nobody can access the database or monitoring server directly ... as of now. My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available. On top of that you may run into issues when scanning ...


0

Fuzzing is a form of vulnerability testing. But vulnerability testing is not necessary a form of fuzzing. Some vulnerability scanners might use fuzzing techniques, modules or plugins to do so. For example Nessus has the following plugins to approach "unknown" issues in web applications (source): 44967: CGI Generic Command Execution Vulnerability (time ...


4

The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. In the case of web applications: injections and so on. It is possible that a vulnerability scanner can include some sort of fuzzing as one of the tests it ...



Top 50 recent answers are included