Questions tagged [vulnerability-scanners]
A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
343
questions
0
votes
0answers
47 views
IT-security grade vulnerability scanners for Android? [closed]
This is a question for android security pros:
What IT-security grade tools are there for android vulnerability assessment ?
In the old days there was Android-VTS which was opensource, would test ...
2
votes
1answer
51 views
What is extension intolerance in the context of TLS?
SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
0
votes
0answers
23 views
Arachni on Mac OS X Catalina [migrated]
Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications, I never use it before ...
0
votes
1answer
30 views
Nikto nocache option
I found an option
-nocache : Disable response cache
in here
https://cirt.net/nikto2-docs/options.html
But when I tried it, I always get this error
Unknown option: nocache
0
votes
2answers
66 views
Nikto giving incoherent results [closed]
I'm running a scan with Nikto. The command I'm running is pretty simple:
nikto -h 192.168.1.15 -p 5050
It's a Node.js server. But I get a gazillion vulnerabilitites, for instance:
OSVDB-19947: /...
0
votes
1answer
54 views
How to better manage Qualys WAS for 30 sites that are scanned monthly
I was giving the responsibility of a Qualys WAS. There are around 30 sites I need to monthly scan, and check alerts. I need to automate all this process so I'm thinking on this
Create a script or ...
0
votes
1answer
62 views
Vulnerable stored Linux kernel version
I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:
user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3....
0
votes
1answer
61 views
VeraCode static code scan reports “Improper Neutralization of CRLF Sequences in HTTP Headers” for frontend code
I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery.
var csrftoken = self.getCookie('csrftoken');
...
1
vote
1answer
62 views
VeraCode static code scan of django view reports “External control of Filename or Path” on render method
Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is:
return render(request, 'core/create-...
0
votes
1answer
33 views
vulnerability scanner report to SIEM
Our partners require such configuration as
1) vulnerability scanner A (well known in CIS area)
2) SIEM B (leaders of the market)
And they should perform a scan of the network, get a report then ...
0
votes
0answers
34 views
Break down the CISecurity OVAL definitions file to smaller definition files
I am working on a project that uses OpenSCAP and the OVAL vulnerability definitions provided by CISecurity (Example definitions file Warning: link will auto-download the file).
This is a huge ...
1
vote
0answers
40 views
How to configure webapplication vuln scanner for local web apps [closed]
I am in the process of evaluating a number of webapp vuln scanners. For this task, I attack intentionally vulnerable web apps. So far I tried:
Scanner > BurpPro Scanner, arachni, ZAP, wapiti, nikto, ...
25
votes
3answers
7k views
Should I report a security vulnerability?
I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?
2
votes
0answers
146 views
Where to run long automated scans? [closed]
I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
0
votes
0answers
92 views
What is the best practice to run Openvas on Azure?
I have created a Kali VM on Azure to use for my pentesting engagement. I was able to access Openvas GM from my desktop, however I could not log in the GM even though I reset my GM password again and ...
-4
votes
1answer
225 views
Pentesting: Active vs Passive Scan [closed]
I couldn't find answers to this question on this forum so I'm just gonna ask:
What are Active Scans and Passive Scans? What are their differences?
Please include in your answer(s):
differences in ...
1
vote
1answer
101 views
Is it reasonable to provide admin access for a PCI vulnerability scan?
My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans.
The contractor is asking for admin access to our ...
0
votes
1answer
194 views
Disabled Network Discovery for port 5357 but it still shows up as open in NMap scan
as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the ...
0
votes
3answers
470 views
Authenticated vs Unauthenticated network scans
What are the differences between authenticated and unauthenticated network scans?
Do they show the same results?
In which scenario should both be used?
1
vote
1answer
76 views
Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?
I'm using a scanner which passes subtraction attack traffic such as (1-1), (3-2), (5-2), etc. There are no break or continuation characters such as semicolons or &&, nor is there a comparison ...
0
votes
1answer
46 views
What is the difference when scanning external IP's from my LAN vs cloud/external scanner?
Im concerned if I am scanning effectively.
When I scan our external IP's with the scanner on my laptop the packets are leaving my network through my firewall and routing across the internet to hit ...
1
vote
1answer
117 views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
1
vote
1answer
119 views
How can I detect CVE-2018-0886 vulnerable hosts in my network?
I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more.
Most ...
0
votes
0answers
63 views
Can I get hold of malicious npm packages?
the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo ...
2
votes
3answers
726 views
Best Practice for Suppressing Fortify SCA Findings
I have been searching for an answer as to how you should treat false positives in Fortify scans.
For a long time, if something was determined to be a false positive, I would document the reasoning ...
2
votes
0answers
44 views
Analyzing binary by ZZUF and PEACH fuzzers
I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
0
votes
2answers
124 views
Identifying a script used for vulnerability scan
The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
2
votes
0answers
64 views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
1
vote
0answers
47 views
Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?
Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?
From InsightVm documentation, the GET scan API call returns only scan info with statistics of ...
0
votes
1answer
113 views
Nikto commandline options
I was reading from Nikto's site on the commandline options used and I am curious about this option
https://cirt.net/nikto2-docs/options.html
-ask
Whether to ask about submitting updates: yes (ask ...
0
votes
0answers
51 views
Authenticated scan strategy for large enterprise network
I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network.
Within this network there are Windows machines and Linux machines.
CyberArk has ...
0
votes
0answers
158 views
How to prevent vulnerability scanning tools from scanning my VPS? [duplicate]
I noticed in the logs that my server is beeing scanned continuously, I know that from apache / postfix/ dovecot logs.
Example from apache error log :
==> error.log <==
[Fri Mar 01 10:11:30....
0
votes
1answer
134 views
Securimage php library for Captcha Code showing security issues in Arachni Scanner
I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
0
votes
0answers
31 views
Check OpenVAS tests
I have a list of security policies that need to be implemented. These are for example:
standard passwords shall not be used and must be replaced
standard admin accounts like root and admin shall be ...
1
vote
0answers
145 views
Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404
I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
2
votes
0answers
41 views
Burp Suite - Mark Issues as “Validated”
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
0
votes
1answer
318 views
Server getting probed: why can I see successful GET requests to other sites?
I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
2
votes
1answer
326 views
How do I scan a WordPress website which blocks WPSCAN from scanning the website?
I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
0answers
162 views
Can OpenVAS do a scan on a scanner device?
I know OpenVAS can scan printers with just tweaking some scan configuration.
I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting.
I have an ...
0
votes
1answer
161 views
Is there anywhere we can scan projects (PHP, JAVA…) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]
Virustotal is excellent in its field.
Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
1
vote
1answer
214 views
HTML payloads work on burp but not on browser
I was looking into bWAPP.
In the HTML GET Injection section, I entered
%25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65
...
1
vote
1answer
245 views
Can you scan unmanaged switches with vulnerability scanners?
The target switches do not have IP addresses and most scanners require IPs as targets.
Can you scan unmanaged switches with vulnerability scanners? What scanners can target layer 2?
1
vote
1answer
242 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
1answer
181 views
Internal HTTP(s) vulnerabilities
We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
1
vote
0answers
67 views
Secure scanning of git repositories
Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ?
In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
0
votes
1answer
545 views
NIKTO: Requires Authentication for realm ''MD5''
I am trying to perform a scanning of a web server using Nikto using:
nikto -id id:pass -h xxx.xxx.xx.xxx
I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
3answers
97 views
Scan for infection of malicious files manually?
I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
797 views
How to discover known vulnerabilities (CVEs) in Go executables? [closed]
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
0
votes
2answers
133 views
Protecting a web app from unwanted vulnerability scanners
I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how ...
0
votes
0answers
122 views
Vulnerability scanner connecting to remote registry service is failing
I am trying to perform full vulnerability scans against all of my corporate PCs, servers and laptops. However, I'm unable to read/connect to the target registry despite the 'Remote Registry' service ...
