Questions tagged [vulnerability-scanners]
A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
380
questions
2
votes
3answers
103 views
How do you test security tools
I am planning to purchase a security tool like fortify, or sonarqube or snyk.
How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks?
Any good ...
1
vote
0answers
50 views
Vulnerability scanners for .efi files
I have an .efi file with some hardware diagnostic tool like Memtest and I need to provide a security assessment for it. I am wondering, if there are any automated scanners, that can scan .efi files ...
0
votes
1answer
32 views
Sqlmapapi configuring task options
I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set.
I could not find any ...
0
votes
0answers
38 views
Appscan not scanning vb files
I was doing SAST of a .NET application (.aspx and .vb) using Appscan source for analysis. I can scan aspx files but I am not able to scan .vb files in Appscan. How do you scan .vb files?
0
votes
1answer
141 views
Why Vulnerability Scanners Ignore Shared Libraries?
First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
0
votes
1answer
64 views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
0
votes
1answer
87 views
Determining applicability of CVEs without CPEs?
I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
1
vote
1answer
99 views
Some random string is appended prefixed by a DOT at the end of URL
Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows.
The request URL which our ...
4
votes
4answers
285 views
Is it good practice to disable firewall rules for vulnerability scanners?
I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols.
Today they are limited by the current ...
0
votes
2answers
212 views
Manually Validating Vulnerabilities from a Vulnerability Scan
How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor?
Say you received a report with a high vulnerability. The vulnerability scanner used a ...
0
votes
1answer
38 views
Creating a separate privileged (admin) user account for authenticated VA scans
When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
0
votes
2answers
105 views
Does it make sense to perform vulnerability assessment tests with admin user rights?
We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities.
Our admin portal is secured with username and ...
0
votes
0answers
295 views
How to disable the use of verb tunneling using such headers or query parameters in .NET?
I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
1
vote
0answers
51 views
Scanning developer dependency for OSS scan
I have a angular project which has several packages that have direct dependencies and developer dependencies like below
"dependencies": {
"@angular/animations": "8.2.14",
...
2
votes
1answer
161 views
Identify crash-inducing NVT in OpenVAS
I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux.
During the scan, multiple targets have crashed. This is obviously something I want to investigate....
0
votes
3answers
142 views
Is is safe to skip virus scanning for image files?
Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous.
Are there any good reasons not ...
1
vote
2answers
106 views
What should be a good Open Source dependency scanning frequency?
We use Snyk as our open source dependency scanner. We currently scan for vulnerable libraries on every pull request and this causes overhead to our developers. What would be a good open source ...
2
votes
1answer
102 views
Container Vulnerability Management
Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
-2
votes
1answer
210 views
Nexpose Vulnerability scanner
Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
0
votes
1answer
88 views
a single ip adress host multiple domain at the same time, how do i scan it using nmap or other tools?
lets say an ip adress 111.111.111.111 host multiple domain, (example.com , exampleid.com , admin.example.com, etc.) and i wanted to scan it port, how do i scan a spesific domain (headers key: Host ...
1
vote
0answers
83 views
Remote file inclusion (RFI) found - vulnerability or false positive?
For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
3
votes
2answers
137 views
Public registry (database or API) for known security vulnerabilities in open source software?
Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software?
Why would anyone want this?
I'm trying to emulate github's ...
0
votes
0answers
55 views
Chrome Vulnerabilities are detected in vulnerability scan even after upgraded with latest versions [duplicate]
Had few chrome vulnerabilities [CVE-2020-6420] detected by BI(Retina). Upgraded the affected machines to chrome version 84.0.4147.89. After re-scan still the same vulnerabilities are detected.
Anyone ...
1
vote
1answer
403 views
Auto-login to refresh token in Burp Suite 2
I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
3
votes
3answers
151 views
Applicability of CVE-2018-14721
My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
13
votes
2answers
3k views
How do hackers search for vulnerabilities on certain ports? [closed]
Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.
0
votes
1answer
83 views
What happens when attacker scan a IP that is used by multiple devices? [duplicate]
Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
1
vote
2answers
4k views
Constant POST request spam to /cgi-bin/ViewLog.asp endpoint
I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests:
POST http://127.0.0.1/cgi-bin/ViewLog.asp
...
1
vote
0answers
432 views
REST API scanning using WebInspect
I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
11
votes
4answers
4k views
JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?
When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
0
votes
2answers
92 views
Servers/Websites for vulnerability scanning
I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known ...
2
votes
2answers
2k views
Qualys WAS raises "150004 Path-Based Vulnerability" on an image file
Customer is running Qualys Web Application Scan and the WAS Scan Report reported:
150004 Path-Based Vulnerability
on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
2
votes
2answers
349 views
Old browser version connected to server
I am using securityscorecard.com to security test some web sites. One of the issues it has flagged is "Outdated web browser observed". Full description is as follows...
The web is constantly ...
1
vote
0answers
350 views
Shell scripts scanning tools
It has become common trend to use shell scripts from the web and directly run them:
bash <(curl -sL some.random.website.com)
I always view the script before running them. However, shell scripts ...
-1
votes
1answer
73 views
How to understand the client-server structure of Host-based Vulnerability Scanner?
We know that vulnerability scanners have three model types: Host-based, Network and Database.
The Host-based vulnerability scanner uses a client-server structure, and the host will run an agent.
...
0
votes
1answer
146 views
What is the best way for OWASP Zap to handle Unique Fields and API Sequences?
First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
1
vote
1answer
553 views
Security Report about "Insecure Content-Type Setting": Does this apply to CSS and JavaScript as well?
I am working through a report of an automated vulnerability scanner. One Item is
Web Server Misconfiguration: Insecure Content-Type Setting ( 11359 )
It's about not returning the character-set for ...
1
vote
2answers
1k views
What is the best way to get OWASP ZAP to fuzz parameters with real data?
I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
1
vote
1answer
89 views
Web vulnerability scanners with API [closed]
I want to automate web vulnerability scanning and generate a HTML/PDF report.
Are there any WVS that offer a scanning and reporting API? If so, what are some examples?
0
votes
1answer
891 views
Stop an in-progress passive scan in OWASP ZAP 2.9
I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all.
I have disabled all ...
1
vote
2answers
140 views
What types of vulnerabilities just can't be located by a default scanner?
If I'm wiling to test a web application.
For what types of vulnerabilities can't a application scanner scan and where can't a application scanner scan (eg. in what property) by its most "forces"?
...
32
votes
5answers
7k views
Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?
I'm reading a white hat hacking book from a famous certification.
They say the methodology for hacking a web server is:
information gathering (domain name, DNS, IP, etc.)
footprinting (ex: banner ...
2
votes
1answer
124 views
What is extension intolerance in the context of TLS?
SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
0
votes
1answer
86 views
Nikto nocache option
I found an option
-nocache : Disable response cache
in here
https://cirt.net/nikto2-docs/options.html
But when I tried it, I always get this error
Unknown option: nocache
0
votes
2answers
370 views
Nikto giving incoherent results [closed]
I'm running a scan with Nikto. The command I'm running is pretty simple:
nikto -h 192.168.1.15 -p 5050
It's a Node.js server. But I get a gazillion vulnerabilitites, for instance:
OSVDB-19947: /...
0
votes
1answer
192 views
Vulnerable stored Linux kernel version
I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:
user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3....
1
vote
2answers
331 views
VeraCode static code scan reports "Improper Neutralization of CRLF Sequences in HTTP Headers" for frontend code
I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery.
var csrftoken = self.getCookie('csrftoken');
...
1
vote
1answer
165 views
VeraCode static code scan of django view reports "External control of Filename or Path" on render method
Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is:
return render(request, 'core/create-...
0
votes
1answer
82 views
vulnerability scanner report to SIEM
Our partners require such configuration as
1) vulnerability scanner A (well known in CIS area)
2) SIEM B (leaders of the market)
And they should perform a scan of the network, get a report then ...
1
vote
0answers
178 views
How to configure webapplication vuln scanner for local web apps [closed]
I am in the process of evaluating a number of webapp vuln scanners. For this task, I attack intentionally vulnerable web apps. So far I tried:
Scanner > BurpPro Scanner, arachni, ZAP, wapiti, nikto, ...