Questions tagged [vulnerability-scanners]
A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
323
questions
0
votes
1answer
39 views
What is the difference when scanning external IP's from my LAN vs cloud/external scanner?
Im concerned if I am scanning effectively.
When I scan our external IP's with the scanner on my laptop the packets are leaving my network through my firewall and routing across the internet to hit ...
1
vote
1answer
66 views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
1
vote
1answer
97 views
How can I detect CVE-2018-0886 vulnerable hosts in my network?
I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more.
Most ...
0
votes
0answers
50 views
Can I get hold of malicious npm packages?
the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo ...
0
votes
1answer
130 views
Best Practice for Suppressing Fortify SCA Findings
So I have been searching for an answer as to how you should treat false positives in Fortify scans.
For a long time if something was determined to be a false positive I would document the reasoning ...
2
votes
0answers
35 views
Analyzing binary by ZZUF and PEACH fuzzers
I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
0
votes
2answers
115 views
Identifying a script used for vulnerability scan
The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
2
votes
0answers
60 views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
1
vote
0answers
33 views
Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?
Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?
From InsightVm documentation, the GET scan API call returns only scan info with statistics of ...
0
votes
1answer
59 views
Nikto commandline options
I was reading from Nikto's site on the commandline options used and I am curious about this option
https://cirt.net/nikto2-docs/options.html
-ask
Whether to ask about submitting updates: yes (ask ...
0
votes
0answers
35 views
Authenticated scan strategy for large enterprise network
I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network.
Within this network there are Windows machines and Linux machines.
CyberArk has ...
0
votes
0answers
78 views
How to prevent vulnerability scanning tools from scanning my VPS? [duplicate]
I noticed in the logs that my server is beeing scanned continuously, I know that from apache / postfix/ dovecot logs.
Example from apache error log :
==> error.log <==
[Fri Mar 01 10:11:30....
0
votes
1answer
75 views
Securimage php library for Captcha Code showing security issues in Arachni Scanner
I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
0
votes
0answers
28 views
Check OpenVAS tests
I have a list of security policies that need to be implemented. These are for example:
standard passwords shall not be used and must be replaced
standard admin accounts like root and admin shall be ...
1
vote
0answers
102 views
Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404
I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
2
votes
0answers
28 views
Burp Suite - Mark Issues as “Validated”
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
0
votes
1answer
186 views
Server getting probed: why can I see successful GET requests to other sites?
I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
2
votes
1answer
202 views
How do I scan a WordPress website which blocks WPSCAN from scanning the website?
I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
0answers
136 views
Can OpenVAS do a scan on a scanner device?
I know OpenVAS can scan printers with just tweaking some scan configuration.
I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting.
I have an ...
0
votes
1answer
156 views
Is there anywhere we can scan projects (PHP, JAVA…) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]
Virustotal is excellent in its field.
Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
1
vote
1answer
139 views
HTML payloads work on burp but not on browser
I was looking into bWAPP.
In the HTML GET Injection section, I entered
%25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65
...
1
vote
1answer
154 views
Can you scan unmanaged switches with vulnerability scanners?
The target switches do not have IP addresses and most scanners require IPs as targets.
Can you scan unmanaged switches with vulnerability scanners? What scanners can target layer 2?
1
vote
1answer
175 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
1answer
125 views
Internal HTTP(s) vulnerabilities
We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
1
vote
0answers
53 views
Secure scanning of git repositories
Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ?
In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
0
votes
1answer
374 views
NIKTO: Requires Authentication for realm ''MD5''
I am trying to perform a scanning of a web server using Nikto using:
nikto -id id:pass -h xxx.xxx.xx.xxx
I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
3answers
85 views
Scan for infection of malicious files manually?
I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I ...
1
vote
2answers
613 views
How to discover known vulnerabilities (CVEs) in Go executables? [closed]
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
0
votes
2answers
114 views
Protecting a web app from unwanted vulnerability scanners
I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how ...
0
votes
0answers
78 views
Vulnerability scanner connecting to remote registry service is failing
I am trying to perform full vulnerability scans against all of my corporate PCs, servers and laptops. However, I'm unable to read/connect to the target registry despite the 'Remote Registry' service ...
0
votes
1answer
99 views
Server vulnerability scanning [closed]
How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security.
Thanks in advance
0
votes
1answer
390 views
Vulnerability scanners for web APIs [closed]
I've built a few web APIs for my company at intellectstorm.com and I'm tasked to test these products by scanning for vulnerabilities. I can't decide on a good tool as yet; so far I've used the ...
1
vote
2answers
51 views
Using SELinux to isolate a binary AV scanner to only doing its job, scanning and detecting
This question is a "would it be possible" rather than a "how to".
Can SELinux isolate a binary AV scanner, Kaspersky Endpoint Security for Linux for an example, to only do whats its suppose to do ...
0
votes
1answer
1k views
What is the risk of private IP address disclosure if it is the user IP?
I am checking a web application with OWASP Zed Attack Proxy (ZAP).
There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
0
votes
1answer
265 views
over 100 scanner requests 5 min after domain registration
First off, I am no security expert!
Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...
1
vote
1answer
4k views
Scan a web application in OpenVAS
As the title says.
How can I do it in OpenVAS?
The other group has a website for example: https://thiswebsite.com/main.php
and in that website there is a web application for example: https://...
-1
votes
1answer
195 views
Attack Surface Analyzer report possible actions [closed]
I am using Microsoft's Attack Surface Analyzer, and I would like to get a better understanding of what would be the best way to mitigate the findings.
For example if in my report I get Directories ...
4
votes
2answers
2k views
OpenVAS won't generate SCAP Database
To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...
4
votes
1answer
190 views
Is it possible to invoke OS commands from a NASL script in OpenVAS?
I was wondering if it is possible to run a command like cat, w3m or any other Operating System (Linux) utility from inside a NASL script and use its output. Do you know any examples? I know you can ...
1
vote
3answers
231 views
nikto's results differ from other vulnerability scanners , is it more or less accurate?
I was doing some scanning on a web application, I used OWASP zap and Nessus. The risks that these two detected were medium to low, very few vulnerabilities.
Then I tried nikto, and the results were ...
2
votes
1answer
5k views
Nikto authentication
I am trying to complete a war game on Hell Bound Hackers.
I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, ...
1
vote
1answer
1k views
Change settings to scan a printer with openvas
I have Openvas 5.1.1 (gui: Greenbone Security Assistant Version 7.0.2).
It misidentifies my linux server as a printer. Scan result includes
Solution
If you want to scan the remote host, uncheck ...
0
votes
1answer
4k views
How to fix Path Disclosure Vulnerability?
I have run a Qualys Web Application Scan for a customer website and found the "Path Disclosure Path-Based Vulnerability".
If the normal URL is like this http://example.com/
When I go to the URL http:/...
0
votes
1answer
650 views
Detect and Scan Open Ports
I am trying to understand two questions -
I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
12
votes
2answers
3k views
Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners
Performed credentialed Vulnerability scan on linux/Unix servers by Nessus and thousand of vulnerability came out of port tcp/0. How could a IANA reserved port(tcp/0) handle traffic? Are those ...
1
vote
2answers
103 views
After a full web vulnerability scan, do we need to test each & every similar field for possible injections?
I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also.
But ...
1
vote
1answer
281 views
How is the create-react-app package tree properly sanitized?
React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework.
From a security perspective, sanitizing all the ...
1
vote
2answers
873 views
Using burp-rest-api, how do I log into my web application in order to scan for vulnerabilities?
I am using the VMWare-developed Burp API (https://github.com/vmware/burp-rest-api) in order to try to automate web application scanning for my application. For an example, if I was attempting to test ...
1
vote
1answer
212 views
How vulnerability scanners identify version of services on targets
I would like to know that how vulnerability scanners identify the version of services running on the target after identifying the service by the port number.
3
votes
1answer
4k views
Potential False Positive while scanning a network with Nexpose - X509 Certificate mismatch [closed]
Little bit of context, we are seeing this finding a lot.
We use wildcard certificates on public facing websites.
The finding is titled:
"X.509 Certificate Subject CN Does Not Match the Entity ...
