A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

5
votes
0answers
36 views

How could I train a ML system to identify vulnerabilities in code? [on hold]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
5
votes
2answers
85 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
0
votes
0answers
18 views

Why is nginx returning 301 for domains not matching mine? [migrated]

I'm seeing what looks like scanning traffic in nginx access.log (perhaps looking for an open relay?) HEAD http://www.sina.com.cn HTTP/1.1" -/- 301 0 GET http://www.qunar.com/ HTTP/1.1" -/- 301 178 ...
0
votes
0answers
12 views

Where can I find the w3af attack plugins?

I am reading the documentation of w3af (a famous and very practical program to scan web servers for vulnerabilities). There I read that there is type of plugin called "attack plugins", but I can't ...
3
votes
1answer
22 views

SHA 1 no impact to root certificate

I ran a scan on a server and the results of the authentication for digital certificate was as follows : Certificate 1 (root) signature algorithm: Sha256withRSA Certificate 2 (chain of trust) ...
13
votes
4answers
3k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
1
vote
1answer
48 views

Is OpenVas an active or passive scanner? [closed]

I am using Ossim and I did a scan vulnerabilities with OpenVas. I received feedback that some of our softwares broke after the scan. We will check the logs to see if the scan cause this, but I was ...
8
votes
1answer
166 views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, ...
2
votes
1answer
60 views

Is possible for a vulnerability search engine to detect the ipv6 adresses?

Using IPV4 protocol, vulnerability search engines can detect and index Internet connected devices. It will be easy for a hacker to collect a lot of information about some devices and perform an ...
1
vote
2answers
48 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
0
votes
1answer
47 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
1
vote
1answer
85 views

Nessus report shows iSCSI vulnerability

The IT Manager (my boss) has been running a vulnerabilities scan on a network of servers we have. The report has come back with some interesting vulnerabilities. The one I can't seem to find a lot on ...
0
votes
0answers
28 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
0
votes
1answer
36 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
-1
votes
1answer
74 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their ...
0
votes
1answer
76 views

How does Netsparker extract the version of SQL Server during a SQL injection?

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities. However I am surprised as the injection query throw error for casting and the scanner ...
3
votes
1answer
143 views

OpenSSH < 7.0 Multiple vulnerabilities question

Nessus reports this as Critical however there are issues such as 'CVE-2015-5600' that CVE is 8.5 but Red Hat reports it as a 'Low' issue. https://access.redhat.com/security/cve/CVE-2015-5600 Reports ...
8
votes
2answers
114 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
-2
votes
1answer
94 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
6
votes
1answer
328 views

Industry best practices for vulnerability scanning and management?

I am looking for reference documents or talks as to the end results for a vulnerability assessment, scanning, and management process at a fully matured "impressive" level for a large organization that ...
-2
votes
1answer
113 views

Check which ports are left open (vulnerable) and accessible in Windows OS from the Internet

Since open ports are a security risk, I would like to know which ports are open to the Internet (outside my network). I wouldn't think of all open ports as security vulnerabilities just the ones ...
1
vote
1answer
248 views

Vulnerability scanning of AngularJS web app fails due to '#' in url

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format ...
5
votes
1answer
48 views

Safely Experimenting With Sockets

I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios: 1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on ...
4
votes
1answer
52 views

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to ...
4
votes
2answers
121 views

IBM AppScan false positive

I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue. How is AppScan able to find vulnerabilities while I ...
1
vote
2answers
212 views

Virus-total offline Alternatives [duplicate]

These days I am working on FUDing my own written backdoor, RATs, etc. what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?
3
votes
1answer
161 views

Received UDP packet with IP ID of zero:

I am scanning a host in our network with Nexpose and one of the vulnerabilities reported is Received UDP packet with IP ID of zero: IPv4 SRC[10.0.0.5] TGT[127.0.0.1] TOS[192] TTL[64] Flags[40] ...
0
votes
0answers
31 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
3
votes
4answers
188 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
-2
votes
1answer
38 views

Web Application Security Scanner Identification [duplicate]

We got following URLs in our access logs. No referrer. Chrome user agent. Looks like some security scanner is/was at work. Is it possible to identify it? Many urls have references to netsparker. / ...
0
votes
2answers
56 views

SQLMap using “?ref=”

I'm learning about net security and how to deal with SQLmap. A friend made some demo web pages on his server to test SQLmap. One of the pages is a fake phishing site with a refer to a real site ...
3
votes
1answer
46 views

Should we keep our penetration testing environment separate from other test infrastructure?

Given that there are N number of hosts on a given network being used for different purpose, should we place a machine for penetration testing or vulnerability scanning on same LAN or should we have ...
1
vote
0answers
119 views

Can I use OpenVAS to keep up with Cisco security advisories?

I'm assuming this question is more security-centric so I'm posting it here instead of server fault. I'm new to automated vulnerability scanning and I'm trying to wrap my head around what OpenVAS does ...
2
votes
2answers
181 views

Web site vulnerability discovery by scanner

I have a web site which require user login and password before they can access any materials and use the services. However, a recent VA scan found that one URL link is vulnerable to a an old version ...
3
votes
1answer
422 views

How to Verify Qualys QID 42366 - SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Server Side Vulnerability (BEAST)

My company uses Qualys to scan for vulnerabilities in our apps. I received a report with four vulnerabilities (related to SSLv3 and ciphers), and I could google each one and land on page from Qualys ...
11
votes
4answers
354 views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
2
votes
1answer
205 views

Have questions about received security scan

I received a security scan from Fortify on a webapp (using SSL/HTTPS) written in Angular that I am working on and I have two questions (high risk issues) that I'm seeking help on. Access Control: ...
2
votes
2answers
90 views

Legally port scanning (Whitelist)

I am attempting to set up a security vulnerability scanning server. I have several customers interested in using it to scan their systems. I will be port scanning and carrying out intrusion detection, ...
3
votes
2answers
331 views

Nikto scan says “Uncommon Header”

I have a problem with the Nikto Web Scanner. I would like to scan a site but Nikto returned the response with a HTTP 403 status code: After that I tried to change the USERAGENT in nikto.conf. Nikto ...
2
votes
2answers
78 views

Vulnerability scanning: White list pentester or not?

If your company engages a third party pentester to do vulnerability scanning, do you whitelist the pentester so that they can thoroughly scan the machines on the internet, or do not whitelist them ...
2
votes
1answer
139 views

Reliability of scanning tools on icmp timestamp responses

A security auditor has done a vulnerability scan of our network and found that one of our server has returned an TCP timestamp response such that the scanner (Nmap) is able to guess the uptime of the ...
4
votes
3answers
63 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
4
votes
1answer
113 views

Approach business(es) with security vulnerabilities

As a security researcher, I have become familiar with different related tools and software packages. The other day, I opened up one of those software packages and was attempting to attack a personal ...
0
votes
0answers
124 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
1
vote
0answers
131 views

Add custom information to OpenVas reports [closed]

I am using OpenVas to scan several different networks and aggregate those reports into RSA Archer. Archer supports breaking hardware up into different Business Units/Divisions etc., and I would like ...
0
votes
2answers
88 views

Client misunderstanding nmap [closed]

My client wants their public facing IP addresses to be secure, but thinks that running nmap port scans will draw attention from hackers. To settle this once and for all, what do you say?
3
votes
1answer
3k views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
1
vote
3answers
179 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
1
vote
1answer
110 views

Credentials for scanning a database server's vulnerabilities [closed]

what is the required credentials for scanning a database server's vulnerabilities by using vulnerability assessment tools such as Rapid 7 Nexpose?
0
votes
1answer
42 views

openvas omp tool is not able to parse target option

I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error. $ omp -u test -w ...