0

I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how to fix them.

The scans are using Acunetix and BeyondTrust software.

Is there a method I can use to protect my web application from such unwanted scans?

  • 2
    Fix the vulnerabilities? – hft Sep 18 '18 at 18:10
  • I'm not sure what your goal is. If your goal is to make sure that these vulnerabilities (which you yourself find convincing) go way then you must fix the application which shows the vulnerabilities. If you instead just don't want to get pointed out that you have vulnerable software just delete the reports without taking a closer look at the problems. Of course, fixing the problems is the proper way to do since there is no vulnerability scanner actually needed to find and exploit the problems - it only makes it simpler. – Steffen Ullrich Sep 18 '18 at 18:12
  • Acunetix offer a free trial of their scans. Otherwise, you can use a free software tool like OWASP zaproxy and do your own scans and look into the issues. Otherwise, so long as the web application is Internet facing and does not require authentication, it can be scanned. – NASAhorse Sep 25 '18 at 21:35
3

Is there a method i can use to protect my web application from such unwanted scans to my web application?

You can protect your web application by:

  • using secure coding practices,
  • diligently patching software,
  • implementing a Web Application Firewall,
  • regular approved scanning of the type offered by these 'security experts' (and remediation of their findings),
  • Application Security Testing,
  • (not an exhaustive list.)

Note that in these cases you'll still get scanned - both by these 'security experts', who are contacting you after the fact, and by the 'hackers', who you don't know about because they haven't contacted you.

As long as your application is on the Internet, it'll get scanned. Constantly.

1

Short Answer: No.

Long Answer: It is on the internet so anyone can do whatever they want to it. Put the sites behind a firewall and limit to internal clients, leave it outside but require auth, or fix the vulnerabilities.

  • I understand. So basic php auth for instance in php would deny scanners access? – Gandalf Sep 18 '18 at 18:30
  • 1
    Hey Gandalf - It would deny them from getting access to the content of the page. Which would not allow the scanners to be able to audit page content vulns. They'd still be able to see if your web server (i.e. nginx) was configured wrong, etc. But requiring auth is a great start. – Joe M Sep 18 '18 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.