Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

Filter by
Sorted by
Tagged with
1 vote
0 answers
100 views

out-of-band data exfiltration Command Injection [closed]

A few days ago I found a vulnerability in a site of scope using the Burp suite scanner with the command nslookup xxx.burpcolaborator.com exploit with the following feature: Issue: OS command injection ...
Deviandorx's user avatar
1 vote
0 answers
72 views

Blind SQL Injection on a HP printer?

The vulnerability test from Nexpose scanned the HP printers and last scan shows "Blind SQL Injection / Remedation plan: Ensure that the Web application validates and encodes user input before ...
Karo1337's user avatar
2 votes
2 answers
213 views

Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it

I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build. Debian's security tracker states it's fixed: https://security-tracker.debian....
Roman Grazhdan's user avatar
24 votes
3 answers
5k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
0 votes
0 answers
71 views

Network vulnerability scanner optimal positioning in network

Scenario: There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
spaceMerc's user avatar
0 votes
2 answers
137 views

How do I secure a host with an old OS without upgrading?

In an environment where some computers can't be updated due to legacy software (think air traffic control) an automated vulnerability scanner finds an old machine with an obsolete OS. The sheer ...
StackExchanger's user avatar
0 votes
1 answer
254 views

Blocking vulnerability sniffers on shared hosting through .htaccess file

I have a website that is not using Wordpress, and which is on a shared hosting running Apache. The .htaccess file already has already has around 300 rules, denying IP and unwanted user agents, but ...
OuzoPower's user avatar
  • 149
1 vote
2 answers
171 views

How to reason about CVEs packaged in other open source software

I am reasoning about how to form a policy on CVEs found in software components that do not come from the software itself, but comes in a built-in dependency of that software. Take the example of a ...
Tomas's user avatar
  • 111
0 votes
0 answers
148 views

Which vulnerability scanner is correct?

We use latest ose-cli from RedHat official repository, which claims there are no security issues and rating is "A: This image does not contain known unapplied security advisories.": https://...
tomas's user avatar
  • 101
1 vote
1 answer
439 views

Fluid Attacks SATS Scan Taking a Very Long Time

I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using ...
MidnightJava's user avatar
1 vote
1 answer
429 views

Vulnerability scanning on target Android device

Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network? If not, is there any specific scanning tool that scans for CVE on ...
Ajay's user avatar
  • 41
0 votes
0 answers
189 views

Web app vulnerability scanning: how many URLs to check?

Scanning all of spidered URLs with a tool such as OWASP Zap can be computationally expensive on large apps. Have there been any studies on the adequate number of URLs (just the unique resources) to ...
postoronnim's user avatar
0 votes
1 answer
323 views

Why use OWASP ZAP when it could damage the web application?

OWASP ZAP is used to scan vulnerability on web application but its site says " Because this is a simulation that acts like a real attack, actual damage can be done to a site’s functionality, data,...
wis's user avatar
  • 3
1 vote
1 answer
172 views

How to use parameters from response in new request in Nuclei?

I need to use Nuclei to create some templates for a site. But to locate the bug, I have to use some information that the site returns after the first request. Is it possible to take it from the ...
Sychikov's user avatar
1 vote
2 answers
430 views

Coverity flags as unsafe deserialisaton. Is this vulnerable?

Coverity shows the block of code as unsafe deserialization: String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
warrior-oo7's user avatar
0 votes
0 answers
79 views

Authenticated application scans across thousands of webapps with different credentials

Assuming a SOC in a Big Cap company which has >3000 web applications. Web App scans are performed at the moment, but they scratch the surface as scans are unauthenticated. As there is no way SSO ...
moutonjr's user avatar
  • 101
3 votes
1 answer
918 views

Checking if an arbitrary file exists on the server can be considered Path Traversal?

I ran a SAST Analysis on a project I'm working on and the tool reports the following snippet as a Relative Path Traversal vulnerability (CWE-23): [Authorize] [HttpPut("exists")] public async ...
Rafael's user avatar
  • 55
1 vote
1 answer
447 views

Vulnerability scanner for the custom jquery files

Our solution contains jquery and javascript files. We want to integrate a scanning tool for these files. We are already using one tool for static code analysis and it is unable to identify the ...
NutsAndBolts's user avatar
1 vote
1 answer
382 views

ICMP timestamp - firewall configured to drop timestamp request, but vulnerability scanner can send request and get a response

We use an external scanner (Qualys) to scan our external assets. We have a firewall in front of the external assets, but it is configured to whitelist the scanner so that the external assets get ...
Halooooo's user avatar
1 vote
0 answers
77 views

Code with BoF that cannot be detected by symbolic execution

I am having troubles finding and understanding when symbolic execution fail. From my understanding tools like PathCrawler use symbolic execution. I gave it this code: #include <stdio.h> #include ...
RudeusGreyrat's user avatar
0 votes
2 answers
807 views

A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name

I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name I don't know why it's still producing a vulnerability ...
Marion Lee's user avatar
0 votes
0 answers
156 views

How to interpret a GET request by a vulnerability scanner application with seemingly no parameters?

In the weekend one of the servers got targeted by automated scanning attempts, reviewing the logs I noticed a new strategy, but I can't make head or tails of the intent of this attempt. These attempts ...
Clueless_captain's user avatar
1 vote
1 answer
120 views

How do you de-duplicate security risk findings obtained from various different tools?

You potentially use a variety of scanners and processes (e.g. Threat Modelling) which produces a set of overlapping outputs. How do you avoid repeated findings which are duplicated across toolsets?
transcend3nt's user avatar
0 votes
1 answer
255 views

Is a server using CBC without the encrypt_then_mac TLS extension necessarily vulnerable to the LUCKY13 attack?

In order for a server to be vulnerable to the LUCKY13 exploit, it has to use a ciphersuite which uses CBC and must not use the encrypt_then_mac TLS extension. However, if both these conditions are ...
Tristan Nemoz's user avatar
1 vote
0 answers
3k views

SSLLabs' SSLTest vs. nmap ssl-enum-ciphers

Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
dpr's user avatar
  • 121
0 votes
1 answer
908 views

How to interpret the output of nmap "vulners"

I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it. Is it merely a printout of all the CVEs for this ...
Son of Sam's user avatar
0 votes
0 answers
393 views

how to know CVE affects which Jar/artifact?

When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused. Let's take as an example this CVE: CVE-2022-22978 In the description: "In Spring Security ...
ethicalhacker's user avatar
0 votes
1 answer
17k views

I am trying to exploit port 7000/tcp afs3-fileserver

I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
M4trix's user avatar
  • 1
0 votes
1 answer
148 views

Does Software Composition Analysis scan the source code or environment?

Do all SCA scanners work the same? Do they scan the source or the environment? I've seen some SCA that can scan a folder but also python safety just checks pypi. If both, what are advantages/...
user58446's user avatar
  • 563
0 votes
0 answers
99 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
DaraJ's user avatar
  • 101
0 votes
1 answer
766 views

Scanning for SMBGhost vulnerability

I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
Mahin Chowdhury's user avatar
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
ashdcodes's user avatar
0 votes
1 answer
103 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
user1996's user avatar
1 vote
0 answers
373 views

Scan sg350-28 with Nessus Credentialed checks

I have 4 SG350 (SG350-28 28-Port Gigabit Managed Switch) switches I need to be able to do a Credentialed scans to the switches The problem is when I try to scan it will not connect to port 22, from ...
James Connigan's user avatar
0 votes
0 answers
130 views

How to find out what payloads are being uploaded when I am running a scan of remote website?

I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system. However, my system is connected to a remote VPS via VPN, ...
Shy's user avatar
  • 121
2 votes
3 answers
306 views

How do you test security tools

I am planning to purchase a security tool like fortify, or sonarqube or snyk. How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks? Any good ...
user12158726's user avatar
1 vote
0 answers
114 views

Vulnerability scanners for .efi files

I have an .efi file with some hardware diagnostic tool like Memtest and I need to provide a security assessment for it. I am wondering, if there are any automated scanners, that can scan .efi files ...
Mykyta Miakushka's user avatar
0 votes
1 answer
144 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
Bidon47's user avatar
0 votes
1 answer
446 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
Artem A.'s user avatar
0 votes
1 answer
574 views

Fingerprinting Cisco ASA Device

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
jh2014's user avatar
  • 3
0 votes
1 answer
219 views

Determining applicability of CVEs without CPEs?

I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
Vjz's user avatar
  • 11
1 vote
1 answer
376 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
ThilankaD's user avatar
  • 111
4 votes
4 answers
1k views

Is it good practice to disable firewall rules for vulnerability scanners?

I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols. Today they are limited by the current ...
An Anonymous AWS User's user avatar
1 vote
2 answers
879 views

Manually Validating Vulnerabilities from a Vulnerability Scan

How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor? Say you received a report with a high vulnerability. The vulnerability scanner used a ...
brad_huntington's user avatar
0 votes
1 answer
108 views

Creating a separate privileged (admin) user account for authenticated VA scans

When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
Wageesha De Alwis's user avatar
0 votes
2 answers
245 views

Does it make sense to perform vulnerability assessment tests with admin user rights?

We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities. Our admin portal is secured with username and ...
Max's user avatar
  • 101
0 votes
0 answers
994 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
Cameron's user avatar
  • 101
1 vote
0 answers
169 views

Scanning developer dependency for OSS scan

I have a angular project which has several packages that have direct dependencies and developer dependencies like below "dependencies": { "@angular/animations": "8.2.14", ...
Harsh Vishwakarma's user avatar
2 votes
1 answer
593 views

Identify crash-inducing NVT in OpenVAS

I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux. During the scan, multiple targets have crashed. This is obviously something I want to investigate....
Niklas's user avatar
  • 83
0 votes
3 answers
831 views

Is is safe to skip virus scanning for image files?

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous. Are there any good reasons not ...
davidgo's user avatar
  • 611

1
2 3 4 5
9