Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

Filter by
Sorted by
Tagged with
0
votes
0answers
39 views

Chrome Vulnerabilities are detected in vulnerability scan even after upgraded with latest versions [duplicate]

Had few chrome vulnerabilities [CVE-2020-6420] detected by BI(Retina). Upgraded the affected machines to chrome version 84.0.4147.89. After re-scan still the same vulnerabilities are detected. Anyone ...
1
vote
0answers
45 views

Auto-login to refresh token in Burp Suite 2

I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
3
votes
3answers
106 views

Applicability of CVE-2018-14721

My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
14
votes
2answers
3k views

How do hackers search for vulnerabilities on certain ports? [closed]

Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.
0
votes
1answer
54 views

What happens when attacker scan a IP that is used by multiple devices? [duplicate]

Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
1
vote
2answers
1k views

Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests: POST http://127.0.0.1/cgi-bin/ViewLog.asp ...
1
vote
0answers
129 views

REST API scanning using WebInspect

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
11
votes
4answers
3k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
0
votes
0answers
28 views

automate Checking vulnerabilities on Windows

i'm working on a project (vulnerabilty manager) where i have to find vulnerabilities on different OS's, for linux it's simple i have to check installed packages and match them with CVE list, but what ...
0
votes
2answers
61 views

Servers/Websites for vulnerability scanning

I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known ...
0
votes
1answer
531 views

Qualys WAS raises “150004 Path-Based Vulnerability” on an image file

Customer is running Qualys Web Application Scan and the WAS Scan Report reported: 150004 Path-Based Vulnerability on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
2
votes
2answers
121 views

Old browser version connected to server

I am using securityscorecard.com to security test some web sites. One of the issues it has flagged is "Outdated web browser observed". Full description is as follows... The web is constantly ...
0
votes
0answers
39 views

Shell scripts scanning tools

It has become common trend to use shell scripts from the web and directly run them: bash <(curl -sL some.random.website.com) I always view the script before running them. However, shell scripts ...
0
votes
0answers
91 views

Secure MPLS configuration: Does TCP port 646 (LDP) need to be generally exposed?

I am looking for expertise on MPLS configurations and security. A recent scan of my organization's public IPv4 perimeter networks using Rapid7 InsightVM has discovered a system which appears to be ...
-1
votes
1answer
47 views

How to understand the client-server structure of Host-based Vulnerability Scanner?

We know that vulnerability scanners have three model types: Host-based, Network and Database. The Host-based vulnerability scanner uses a client-server structure, and the host will run an agent. ...
0
votes
1answer
68 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
1
vote
1answer
136 views

Security Report about “Insecure Content-Type Setting”: Does this apply to CSS and JavaScript as well?

I am working through a report of an automated vulnerability scanner. One Item is Web Server Misconfiguration: Insecure Content-Type Setting ( 11359 ) It's about not returning the character-set for ...
1
vote
2answers
291 views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
1
vote
1answer
73 views

Web vulnerability scanners with API [closed]

I want to automate web vulnerability scanning and generate a HTML/PDF report. Are there any WVS that offer a scanning and reporting API? If so, what are some examples?
0
votes
1answer
294 views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
1
vote
2answers
95 views

What types of vulnerabilities just can't be located by a default scanner?

If I'm wiling to test a web application. For what types of vulnerabilities can't a application scanner scan and where can't a application scanner scan (eg. in what property) by its most "forces"? ...
32
votes
5answers
7k views

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

I'm reading a white hat hacking book from a famous certification. They say the methodology for hacking a web server is: information gathering (domain name, DNS, IP, etc.) footprinting (ex: banner ...
2
votes
1answer
77 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
0
votes
1answer
40 views

Nikto nocache option

I found an option -nocache : Disable response cache in here https://cirt.net/nikto2-docs/options.html But when I tried it, I always get this error Unknown option: nocache
0
votes
2answers
78 views

Nikto giving incoherent results [closed]

I'm running a scan with Nikto. The command I'm running is pretty simple: nikto -h 192.168.1.15 -p 5050 It's a Node.js server. But I get a gazillion vulnerabilitites, for instance: OSVDB-19947: /...
0
votes
0answers
66 views

How to better manage Qualys WAS for 30 sites that are scanned monthly

I was giving the responsibility of a Qualys WAS. There are around 30 sites I need to monthly scan, and check alerts. I need to automate all this process so I'm thinking on this Create a script or ...
0
votes
1answer
131 views

Vulnerable stored Linux kernel version

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version: user@host [~]# rpm -q kernel kernel-3.10.0-327.el7.x86_64 kernel-3....
0
votes
1answer
137 views

VeraCode static code scan reports “Improper Neutralization of CRLF Sequences in HTTP Headers” for frontend code

I have the following code in my frontend javascript which basically reads the csrf cookie value and sets that in the ajax calls done via jquery. var csrftoken = self.getCookie('csrftoken'); ...
1
vote
1answer
88 views

VeraCode static code scan of django view reports “External control of Filename or Path” on render method

Veracode is reporting a security issue on a piece of code which seems pretty innocuous to me. The code is built with python/Django and the line in question is: return render(request, 'core/create-...
0
votes
1answer
42 views

vulnerability scanner report to SIEM

Our partners require such configuration as 1) vulnerability scanner A (well known in CIS area) 2) SIEM B (leaders of the market) And they should perform a scan of the network, get a report then ...
0
votes
0answers
42 views

Break down the CISecurity OVAL definitions file to smaller definition files

I am working on a project that uses OpenSCAP and the OVAL vulnerability definitions provided by CISecurity (Example definitions file Warning: link will auto-download the file). This is a huge ...
1
vote
0answers
78 views

How to configure webapplication vuln scanner for local web apps [closed]

I am in the process of evaluating a number of webapp vuln scanners. For this task, I attack intentionally vulnerable web apps. So far I tried: Scanner > BurpPro Scanner, arachni, ZAP, wapiti, nikto, ...
25
votes
3answers
7k views

Should I report a security vulnerability?

I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?
2
votes
0answers
148 views

Where to run long automated scans? [closed]

I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
-4
votes
1answer
403 views

Pentesting: Active vs Passive Scan [closed]

I couldn't find answers to this question on this forum so I'm just gonna ask: What are Active Scans and Passive Scans? What are their differences? Please include in your answer(s): differences in ...
1
vote
1answer
103 views

Is it reasonable to provide admin access for a PCI vulnerability scan?

My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans. The contractor is asking for admin access to our ...
0
votes
1answer
584 views

Disabled Network Discovery for port 5357 but it still shows up as open in NMap scan

as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the ...
0
votes
3answers
1k views

Authenticated vs Unauthenticated network scans

What are the differences between authenticated and unauthenticated network scans? Do they show the same results? In which scenario should both be used?
1
vote
1answer
112 views

Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?

I'm using a scanner which passes subtraction attack traffic such as (1-1), (3-2), (5-2), etc. There are no break or continuation characters such as semicolons or &&, nor is there a comparison ...
0
votes
1answer
52 views

What is the difference when scanning external IP's from my LAN vs cloud/external scanner?

Im concerned if I am scanning effectively. When I scan our external IP's with the scanner on my laptop the packets are leaving my network through my firewall and routing across the internet to hit ...
1
vote
1answer
184 views

What are the benefits of using Nessus in addition to Azure Security Center?

Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management? Or does it have any ...
1
vote
1answer
148 views

How can I detect CVE-2018-0886 vulnerable hosts in my network?

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more. Most ...
0
votes
0answers
78 views

Can I get hold of malicious npm packages?

the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo ...
2
votes
3answers
2k views

Best Practice for Suppressing Fortify SCA Findings

I have been searching for an answer as to how you should treat false positives in Fortify scans. For a long time, if something was determined to be a false positive, I would document the reasoning ...
2
votes
0answers
61 views

Analyzing binary by ZZUF and PEACH fuzzers

I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
0
votes
2answers
130 views

Identifying a script used for vulnerability scan

The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
2
votes
0answers
64 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
1
vote
0answers
48 views

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call? [closed]

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call? From InsightVm documentation, the GET scan API call returns only scan info with statistics of ...
1
vote
1answer
171 views

Nikto commandline options

I was reading from Nikto's site on the commandline options used and I am curious about this option https://cirt.net/nikto2-docs/options.html -ask Whether to ask about submitting updates: yes (ask ...
0
votes
0answers
66 views

Authenticated scan strategy for large enterprise network

I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network. Within this network there are Windows machines and Linux machines. CyberArk has ...

1
2 3 4 5
8