0

I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how to fix them.

The scans are using Acunetix and BeyondTrust software.

Is there a method I can use to protect my web application from such unwanted scans?

Improve this question
3
  • 2
    Fix the vulnerabilities?
    – hft
    Sep 18, 2018 at 18:10
  • I'm not sure what your goal is. If your goal is to make sure that these vulnerabilities (which you yourself find convincing) go way then you must fix the application which shows the vulnerabilities. If you instead just don't want to get pointed out that you have vulnerable software just delete the reports without taking a closer look at the problems. Of course, fixing the problems is the proper way to do since there is no vulnerability scanner actually needed to find and exploit the problems - it only makes it simpler.
    – Steffen Ullrich
    Sep 18, 2018 at 18:12
  • Acunetix offer a free trial of their scans. Otherwise, you can use a free software tool like OWASP zaproxy and do your own scans and look into the issues. Otherwise, so long as the web application is Internet facing and does not require authentication, it can be scanned.
    – NASAhorse
    Sep 25, 2018 at 21:35

2 Answers 2

Reset to default
3

Is there a method i can use to protect my web application from such unwanted scans to my web application?

You can protect your web application by:

  • using secure coding practices,
  • diligently patching software,
  • implementing a Web Application Firewall,
  • regular approved scanning of the type offered by these 'security experts' (and remediation of their findings),
  • Application Security Testing,
  • (not an exhaustive list.)

Note that in these cases you'll still get scanned - both by these 'security experts', who are contacting you after the fact, and by the 'hackers', who you don't know about because they haven't contacted you.

As long as your application is on the Internet, it'll get scanned. Constantly.

Improve this answer
1

Short Answer: No.

Long Answer: It is on the internet so anyone can do whatever they want to it. Put the sites behind a firewall and limit to internal clients, leave it outside but require auth, or fix the vulnerabilities.

Improve this answer
2
  • I understand. So basic php auth for instance in php would deny scanners access?
    – Gandalf
    Sep 18, 2018 at 18:30
  • 1
    Hey Gandalf - It would deny them from getting access to the content of the page. Which would not allow the scanners to be able to audit page content vulns. They'd still be able to see if your web server (i.e. nginx) was configured wrong, etc. But requiring auth is a great start.
    – Joe M
    Sep 18, 2018 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.