Questions tagged [vulnerability-scanners]
A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
409
questions
2
votes
2
answers
44
views
Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it
I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build.
Debian's security tracker states it's fixed: https://security-tracker.debian....
24
votes
3
answers
5k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 343
0
votes
0
answers
36
views
Network vulnerability scanner optimal positioning in network
Scenario:
There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
0
votes
2
answers
105
views
How do I secure a host with an old OS without upgrading?
In an environment where some computers can't be updated due to legacy software (think air traffic control) an automated vulnerability scanner finds an old machine with an obsolete OS.
The sheer ...
0
votes
1
answer
90
views
Blocking vulnerability sniffers on shared hosting through .htaccess file
I have a website that is not using Wordpress, and which is on a shared hosting running Apache.
The .htaccess file already has already has around 300 rules, denying IP and unwanted user agents, but ...
- 149
1
vote
2
answers
89
views
How to reason about CVEs packaged in other open source software
I am reasoning about how to form a policy on CVEs found in software components that do not come from the software itself, but comes in a built-in dependency of that software.
Take the example of a ...
- 111
0
votes
0
answers
96
views
Which vulnerability scanner is correct?
We use latest ose-cli from RedHat official repository, which claims there are no security issues and rating is "A: This image does not contain known unapplied security advisories.":
https://...
- 101
1
vote
1
answer
162
views
Fluid Attacks SATS Scan Taking a Very Long Time
I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using ...
- 111
1
vote
1
answer
173
views
Vulnerability scanning on target Android device
Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network?
If not, is there any specific scanning tool that scans for CVE on ...
- 41
0
votes
1
answer
94
views
Web app vulnerability scanning: how many URLs to check?
Scanning all of spidered URLs with a tool such as OWASP Zap can be computationally expensive on large apps. Have there been any studies on the adequate number of URLs (just the unique resources) to ...
- 436
0
votes
1
answer
218
views
Why use OWASP ZAP when it could damage the web application?
OWASP ZAP is used to scan vulnerability on web application but its site says " Because this is a simulation that acts like a real attack, actual damage can be done to a site’s functionality, data,...
- 3
1
vote
1
answer
88
views
How to use parameters from response in new request in Nuclei?
I need to use Nuclei to create some templates for a site. But to locate the bug, I have to use some information that the site returns after the first request. Is it possible to take it from the ...
- 11
1
vote
2
answers
215
views
Coverity flags as unsafe deserialisaton. Is this vulnerable?
Coverity shows the block of code as unsafe deserialization:
String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled
Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
- 43
0
votes
0
answers
50
views
Authenticated application scans across thousands of webapps with different credentials
Assuming a SOC in a Big Cap company which has >3000 web applications. Web App scans are performed at the moment, but they scratch the surface as scans are unauthenticated.
As
there is no way SSO ...
- 101
3
votes
1
answer
774
views
Checking if an arbitrary file exists on the server can be considered Path Traversal?
I ran a SAST Analysis on a project I'm working on and the tool reports the following snippet as a Relative Path Traversal vulnerability (CWE-23):
[Authorize]
[HttpPut("exists")]
public async ...
- 55
0
votes
0
answers
188
views
Using Nikto to scan for default credentials on Tomcat
I am practicing initial access & privilege escalation using legacy vulnerabilities, particularly the RCE vulnerability on the Tomcat Manager.
I have been trying to use Nikto to first scan the ...
1
vote
1
answer
281
views
Vulnerability scanner for the custom jquery files
Our solution contains jquery and javascript files.
We want to integrate a scanning tool for these files.
We are already using one tool for static code analysis and it is unable to identify the ...
- 111
1
vote
1
answer
226
views
ICMP timestamp - firewall configured to drop timestamp request, but vulnerability scanner can send request and get a response
We use an external scanner (Qualys) to scan our external assets. We have a firewall in front of the external assets, but it is configured to whitelist the scanner so that the external assets get ...
- 11
1
vote
0
answers
43
views
Code with BoF that cannot be detected by symbolic execution
I am having troubles finding and understanding when symbolic execution fail.
From my understanding tools like PathCrawler use symbolic execution. I gave it this code:
#include <stdio.h>
#include ...
0
votes
2
answers
398
views
A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name
I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name
I don't know why it's still producing a vulnerability ...
0
votes
0
answers
109
views
How to interpret a GET request by a vulnerability scanner application with seemingly no parameters?
In the weekend one of the servers got targeted by automated scanning attempts, reviewing the logs I noticed a new strategy, but I can't make head or tails of the intent of this attempt.
These attempts ...
- 121
1
vote
1
answer
89
views
How do you de-duplicate security risk findings obtained from various different tools?
You potentially use a variety of scanners and processes (e.g. Threat Modelling) which produces a set of overlapping outputs. How do you avoid repeated findings which are duplicated across toolsets?
- 99
0
votes
1
answer
162
views
Is a server using CBC without the encrypt_then_mac TLS extension necessarily vulnerable to the LUCKY13 attack?
In order for a server to be vulnerable to the LUCKY13 exploit, it has to use a ciphersuite which uses CBC and must not use the encrypt_then_mac TLS extension. However, if both these conditions are ...
- 103
1
vote
0
answers
2k
views
SSLLabs' SSLTest vs. nmap ssl-enum-ciphers
Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
- 121
0
votes
1
answer
721
views
How to interpret the output of nmap "vulners"
I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it.
Is it merely a printout of all the CVEs for this ...
- 87
0
votes
0
answers
279
views
how to know CVE affects which Jar/artifact?
When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused.
Let's take as an example this CVE: CVE-2022-22978
In the description:
"In Spring Security ...
0
votes
1
answer
12k
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
- 1
0
votes
1
answer
83
views
Does Software Composition Analysis scan the source code or environment?
Do all SCA scanners work the same? Do they scan the source or the environment? I've seen some SCA that can scan a folder but also python safety just checks pypi. If both, what are advantages/...
- 543
0
votes
0
answers
59
views
File traversal vulnerability found on Ubuntu server running a node process using Nessus
I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus.
It looks like a pretty standard issue to me, and I will have shell access, ...
- 101
0
votes
1
answer
533
views
Scanning for SMBGhost vulnerability
I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
0
votes
0
answers
15
views
Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]
I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0
votes
1
answer
71
views
DCP-Portal Vulnerability
This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
- 1
1
vote
0
answers
287
views
Scan sg350-28 with Nessus Credentialed checks
I have 4 SG350 (SG350-28 28-Port Gigabit Managed Switch) switches
I need to be able to do a Credentialed scans to the switches
The problem is when I try to scan it will not connect to port 22, from ...
- 111
0
votes
0
answers
88
views
How to find out what payloads are being uploaded when I am running a scan of remote website?
I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system.
However, my system is connected to a remote VPS via VPN, ...
- 121
2
votes
3
answers
250
views
How do you test security tools
I am planning to purchase a security tool like fortify, or sonarqube or snyk.
How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks?
Any good ...
- 121
1
vote
0
answers
87
views
Vulnerability scanners for .efi files
I have an .efi file with some hardware diagnostic tool like Memtest and I need to provide a security assessment for it. I am wondering, if there are any automated scanners, that can scan .efi files ...
0
votes
1
answer
105
views
Sqlmapapi configuring task options
I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set.
I could not find any ...
- 1
0
votes
1
answer
364
views
Why Vulnerability Scanners Ignore Shared Libraries?
First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
- 3
0
votes
1
answer
454
views
Fingerprinting Cisco ASA Device
I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
- 3
0
votes
1
answer
179
views
Determining applicability of CVEs without CPEs?
I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
- 11
1
vote
1
answer
343
views
Some random string is appended prefixed by a DOT at the end of URL
Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows.
The request URL which our ...
- 111
4
votes
4
answers
941
views
Is it good practice to disable firewall rules for vulnerability scanners?
I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols.
Today they are limited by the current ...
1
vote
2
answers
731
views
Manually Validating Vulnerabilities from a Vulnerability Scan
How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor?
Say you received a report with a high vulnerability. The vulnerability scanner used a ...
0
votes
1
answer
85
views
Creating a separate privileged (admin) user account for authenticated VA scans
When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
0
votes
2
answers
195
views
Does it make sense to perform vulnerability assessment tests with admin user rights?
We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities.
Our admin portal is secured with username and ...
- 101
0
votes
0
answers
903
views
How to disable the use of verb tunneling using such headers or query parameters in .NET?
I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
- 101
1
vote
0
answers
146
views
Scanning developer dependency for OSS scan
I have a angular project which has several packages that have direct dependencies and developer dependencies like below
"dependencies": {
"@angular/animations": "8.2.14",
...
2
votes
1
answer
508
views
Identify crash-inducing NVT in OpenVAS
I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux.
During the scan, multiple targets have crashed. This is obviously something I want to investigate....
- 83
0
votes
3
answers
698
views
Is is safe to skip virus scanning for image files?
Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous.
Are there any good reasons not ...
- 593
1
vote
2
answers
273
views
What should be a good Open Source dependency scanning frequency?
We use Snyk as our open source dependency scanner. We currently scan for vulnerable libraries on every pull request and this causes overhead to our developers. What would be a good open source ...
- 11