A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
0
votes
3answers
40 views
Local network proxy/spoof
Are intruders in a local network able to mask their local IP in any way?
Could they 'hijack' another local IP and perform scans and exploits from there?
0
votes
3answers
44 views
IDS in combination with vulnerability scanner
I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
1answer
54 views
Effectively Pentest a Wordpress Site
When it comes to blackbox pentesting of a wordpress site ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that ...
1
vote
2answers
103 views
Internal / external Penetration testing a webserver - PCI
the PCI DSS document states:
11.3.2
Perform internal penetration testing at least annually and after any significant
infrastructure or application upgrade or modification (such as an operating ...
1
vote
3answers
133 views
What is the security flaw in the following code?
I am reading OWASP Testing Guide v3. The following passage:
Example 1: Magic Parameters
Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
1
vote
0answers
28 views
Matching vulnerabilities with upstream versions
How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions?
> 5.5.29-0ubuntu0.12.04.1
...
1
vote
0answers
29 views
Tomcat 7 and ETags
I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc.
But I am moving to Tomcat 7. ...
1
vote
2answers
106 views
How does one decide whether to block malicious scanning activities?
On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
0
votes
2answers
408 views
MS12-020: Remote Code Execution
I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines.
The report indicates that this could be exploited to allow the execution of code remotely.
To me this would ...
1
vote
0answers
88 views
Nessus scanner and Red Hat backport security updates
I have asked this question:
False positive Apache version in scanner results on Centos
I need additional clarification:
Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
2
votes
2answers
270 views
Is there any useful Android app for security assessments? [closed]
I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
1
vote
2answers
116 views
False positive Apache version in scanner results on Centos
Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version.
Example of false positive vulnerability:
Apache 2.2 < 2.2.16 Multiple Vulnerabilities
Our ...
3
votes
1answer
69 views
Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?
Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting ...
0
votes
1answer
605 views
Nessus No host data is available for this scan error
I encountered an error in Nessus result.
Error:
No host data is available for this scan.
I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
154 views
What is best method for retest blind sql vulnerability
I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
248 views
Import nmap scan results into OpenVAS
I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
2
votes
2answers
98 views
Organizing scheduled vulnerability scans
I am wondering what others do in regards to setting up their enterprise scheduled vulnerability scan policies. For example do you prefer to create a single scan policy and scan all networks regardless ...
0
votes
1answer
229 views
Using timeouts to automatically detect blind sql injection exploits
I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
2
votes
1answer
116 views
I don't quite understand the principle of “use after free” and CVE-2010-1119
I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119".
Unfortunately there does not appear to be enough information online. Could anyone please help me ...
0
votes
2answers
308 views
How can I stop this attack on my router?
After enabling system log on my Asus DSL-N10E router, I've got this message:
DoS: Tcp SYN With Data Attack source=217.74.166.73
What does it mean? Is it a real danger on my network security? And ...
2
votes
5answers
294 views
Vulnerability Scanner vs Security Audit
I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
7
votes
1answer
217 views
How do vulnerability scanners detect when DEBUG is set to True on ASP.NET applications
I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this.
I've ...
10
votes
2answers
391 views
How can a network observer identify computers running old versions of Java?
I received an email earlier today from my ISP (a university). The email reads (in part):
Your network connection has been disabled because your version of Java is not patched for the most recent ...
1
vote
3answers
269 views
Vulnerability scanner shows SQL errors were disclosed.How Severe it is?
When I scanned my site for Vulnerabilities I found this error.
Various SQL errors were disclosed within the application source code or other files.
I have checked for sql injection and confirmed ...
-2
votes
1answer
87 views
What are the security measures to be taken before launching a site with credit card payments? [closed]
We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
8
votes
1answer
1k views
How to audit web servers for resistance/vulnerability to BREACH
BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced.
I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
10
votes
4answers
361 views
How can I audit which type of Block Mode encryption is being used when no source code is available?
Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
2
votes
1answer
623 views
How can I misuse the information of DCE service enumeration?
Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information:
192.168.1.23 - UUID ...
6
votes
1answer
242 views
Is it dangerous “Powered by…” tag
Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
4
votes
1answer
110 views
If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?
In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
0
votes
1answer
446 views
how to access to arachni scanner web interface? [closed]
I have downloaded Arachni package. It is said in the README file to run bin/arachni_web to access to web interface of this scanner.
I run it but no web page appears. I just see these lines:
...
-1
votes
2answers
166 views
How do you search for new vulnerabilities? [closed]
I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
1
vote
1answer
78 views
How do I verify versions of Adobe?
I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
-2
votes
1answer
103 views
w3af plugin development example [closed]
I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck...
Can anyone give me an example how to start building plugins or ...
4
votes
1answer
391 views
Nessus HTML5 version 5.0.3 - PCI Scan
I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
5
votes
3answers
279 views
Failed PCI-DSS Compliance | Submitting Evidence
One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
8
votes
1answer
2k views
How can I stop this DOS attack?
I have this entry appearing constantly in my router logs:
[DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx]
They just never stop. It doesn't seem to affect ...
2
votes
3answers
3k views
How to use information from GHDB and FSDB (Google-Dorks)?
I am new to information security and analysis.
Recently, I came across FSDB (Foundstone database) and GHDB (Google Hacking database) while exploring the McAfee Foundstone Sitedigger tool.
What are ...
3
votes
1answer
140 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
11
votes
3answers
953 views
What bad coding practices makes a browser extension vulnerable?
I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
7
votes
2answers
5k views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
10
votes
2answers
391 views
Any tool for scanning vulnerabilities in browser extensions?
I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
-6
votes
1answer
814 views
How to find bugs/ vulnerabilities in web apps/sites? [closed]
What knowledge is needed?
What software is to be used?
How are the reports written? PS: Websites like facebook.com
3
votes
2answers
109 views
How to assess severity/impact of vulnerability
In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
1
vote
1answer
677 views
Pre Installed OpenVAS , light way Linux [closed]
Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ?
I have used Back Track (UBUNTU ...
0
votes
2answers
410 views
Recomended Nessus Windows-7 scan settings?
In the Nessus FAQ it says
Microsoft Windows desktop systems have network limitations that may
impact the performance of Nessus. The TCP/IP stack limits the number
of simultaneous incomplete ...
2
votes
2answers
293 views
Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?
Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network.
It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
3
votes
5answers
192 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
-1
votes
5answers
725 views
Can I scan with nmap from cloud services? [closed]
Can i conduct nmap scanning from cloud services (i.e AWS)? i am looking to do external scanning for my company and want to set up something that will be quick, efficient, and cheap. I dont want to ...
1
vote
1answer
3k views
my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it
I am supposed to manage the content of a site and it got defaced.
The site is hosted on a Linux server running Apache.
Apache version: 2.2.13
Linux version is Debian 4.0(I think I don't really have ...
