Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

Filter by
Sorted by
Tagged with
1 vote
1 answer
53 views

How do you de-duplicate security risk findings obtained from various different tools?

You potentially use a variety of scanners and processes (e.g. Threat Modelling) which produces a set of overlapping outputs. How do you avoid repeated findings which are duplicated across toolsets?
0 votes
1 answer
21 views

Is a server using CBC without the encrypt_then_mac TLS extension necessarily vulnerable to the LUCKY13 attack?

In order for a server to be vulnerable to the LUCKY13 exploit, it has to use a ciphersuite which uses CBC and must not use the encrypt_then_mac TLS extension. However, if both these conditions are ...
0 votes
0 answers
45 views

SSLLabs' SSLTest vs. nmap ssl-enum-ciphers

Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
  • 111
0 votes
1 answer
107 views

How to interpret the output of nmap "vulners"

I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it. Is it merely a printout of all the CVEs for this ...
0 votes
0 answers
55 views

how to know CVE affects which Jar/artifact?

When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused. Let's take as an example this CVE: CVE-2022-22978 In the description: "In Spring Security ...
0 votes
0 answers
2k views

I am trying to exploit port 7000/tcp afs3-fileserver

I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
  • 1
0 votes
1 answer
27 views

Does Software Composition Analysis scan the source code or environment?

Do all SCA scanners work the same? Do they scan the source or the environment? I've seen some SCA that can scan a folder but also python safety just checks pypi. If both, what are advantages/...
  • 513
0 votes
0 answers
61 views

How to Scan Firebase Database?

I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL. Obviously, the URL is not accessible. I am new to ...
0 votes
0 answers
26 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
  • 101
0 votes
1 answer
119 views

Scanning for SMBGhost vulnerability

I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0 votes
1 answer
48 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
0 votes
0 answers
34 views

How could we fix Microsoft LDAP Enforce Channel Binding CVE-2017-8563?

I had a DC server running Microsoft Windows Server 2008 R2 x64. After a vulnerability scan launched on this server using Nexpose, the CVE-2017-8563 was reported by the vulnerability scanner with the ...
  • 1
1 vote
0 answers
104 views

Scan sg350-28 with Nessus Credentialed checks

I have 4 SG350 (SG350-28 28-Port Gigabit Managed Switch) switches I need to be able to do a Credentialed scans to the switches The problem is when I try to scan it will not connect to port 22, from ...
0 votes
0 answers
61 views

How to find out what payloads are being uploaded when I am running a scan of remote website?

I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system. However, my system is connected to a remote VPS via VPN, ...
  • 101
2 votes
3 answers
168 views

How do you test security tools

I am planning to purchase a security tool like fortify, or sonarqube or snyk. How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks? Any good ...
1 vote
0 answers
78 views

Vulnerability scanners for .efi files

I have an .efi file with some hardware diagnostic tool like Memtest and I need to provide a security assessment for it. I am wondering, if there are any automated scanners, that can scan .efi files ...
0 votes
1 answer
73 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
0 votes
0 answers
68 views

Appscan not scanning vb files

I was doing SAST of a .NET application (.aspx and .vb) using Appscan source for analysis. I can scan aspx files but I am not able to scan .vb files in Appscan. How do you scan .vb files?
0 votes
1 answer
208 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
0 votes
1 answer
197 views

Fingerprinting Cisco ASA Device

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
  • 3
0 votes
1 answer
143 views

Determining applicability of CVEs without CPEs?

I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
  • 1
1 vote
1 answer
175 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
  • 111
4 votes
4 answers
518 views

Is it good practice to disable firewall rules for vulnerability scanners?

I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols. Today they are limited by the current ...
0 votes
2 answers
423 views

Manually Validating Vulnerabilities from a Vulnerability Scan

How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor? Say you received a report with a high vulnerability. The vulnerability scanner used a ...
0 votes
1 answer
72 views

Creating a separate privileged (admin) user account for authenticated VA scans

When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
0 votes
2 answers
137 views

Does it make sense to perform vulnerability assessment tests with admin user rights?

We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities. Our admin portal is secured with username and ...
  • 101
0 votes
0 answers
607 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
  • 101
1 vote
0 answers
85 views

Scanning developer dependency for OSS scan

I have a angular project which has several packages that have direct dependencies and developer dependencies like below "dependencies": { "@angular/animations": "8.2.14", ...
2 votes
1 answer
299 views

Identify crash-inducing NVT in OpenVAS

I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux. During the scan, multiple targets have crashed. This is obviously something I want to investigate....
  • 73
0 votes
3 answers
313 views

Is is safe to skip virus scanning for image files?

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous. Are there any good reasons not ...
  • 593
0 votes
2 answers
181 views

What should be a good Open Source dependency scanning frequency?

We use Snyk as our open source dependency scanner. We currently scan for vulnerable libraries on every pull request and this causes overhead to our developers. What would be a good open source ...
  • 1
2 votes
1 answer
151 views

Container Vulnerability Management

Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
-2 votes
1 answer
253 views

Nexpose Vulnerability scanner

Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
  • 21
0 votes
1 answer
146 views

a single ip adress host multiple domain at the same time, how do i scan it using nmap or other tools?

lets say an ip adress 111.111.111.111 host multiple domain, (example.com , exampleid.com , admin.example.com, etc.) and i wanted to scan it port, how do i scan a spesific domain (headers key: Host ...
1 vote
0 answers
126 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
  • 423
3 votes
2 answers
181 views

Public registry (database or API) for known security vulnerabilities in open source software?

Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software? Why would anyone want this? I'm trying to emulate github's ...
  • 1,214
0 votes
0 answers
86 views

Chrome Vulnerabilities are detected in vulnerability scan even after upgraded with latest versions [duplicate]

Had few chrome vulnerabilities [CVE-2020-6420] detected by BI(Retina). Upgraded the affected machines to chrome version 84.0.4147.89. After re-scan still the same vulnerabilities are detected. Anyone ...
  • 1
1 vote
1 answer
665 views

Auto-login to refresh token in Burp Suite 2

I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
  • 13
3 votes
3 answers
202 views

Applicability of CVE-2018-14721

My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
13 votes
2 answers
4k views

How do hackers search for vulnerabilities on certain ports? [closed]

Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.
0 votes
1 answer
113 views

What happens when attacker scan a IP that is used by multiple devices? [duplicate]

Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
0 votes
2 answers
6k views

Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests: POST http://127.0.0.1/cgi-bin/ViewLog.asp ...
  • 101
1 vote
0 answers
664 views

REST API scanning using WebInspect

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
  • 177
11 votes
4 answers
6k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
  • 213
0 votes
2 answers
137 views

Servers/Websites for vulnerability scanning

I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known ...
  • 3
2 votes
2 answers
4k views

Qualys WAS raises "150004 Path-Based Vulnerability" on an image file

Customer is running Qualys Web Application Scan and the WAS Scan Report reported: 150004 Path-Based Vulnerability on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
2 votes
2 answers
532 views

Old browser version connected to server

I am using securityscorecard.com to security test some web sites. One of the issues it has flagged is "Outdated web browser observed". Full description is as follows... The web is constantly ...
2 votes
0 answers
733 views

Shell scripts scanning tools

It has become common trend to use shell scripts from the web and directly run them: bash <(curl -sL some.random.website.com) I always view the script before running them. However, shell scripts ...
  • 221
-1 votes
1 answer
113 views

How to understand the client-server structure of Host-based Vulnerability Scanner?

We know that vulnerability scanners have three model types: Host-based, Network and Database. The Host-based vulnerability scanner uses a client-server structure, and the host will run an agent. ...
  • 136

1
2 3 4 5
8