Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

Filter by
Sorted by
Tagged with
122 votes
8 answers
9k views

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:...
hsnm's user avatar
  • 1,291
5 votes
3 answers
7k views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
dorothy's user avatar
  • 725
5 votes
1 answer
4k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
augustin's user avatar
  • 185
0 votes
2 answers
457 views

Protecting a web app from unwanted vulnerability scanners

I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how ...
Gandalf's user avatar
  • 107
11 votes
6 answers
9k views

Whats the probability of a personal computer being hacked?

For a normal computer user following these practices: Have an up to date anti-virus with a firewall installed (Norton). Do not install cracked software. Do not open suspicious links or download ...
user avatar
11 votes
3 answers
6k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
Magnus's user avatar
  • 1,204
6 votes
3 answers
1k views

How do I test and secure ASN.1 Parsers?

As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
makerofthings7's user avatar
3 votes
3 answers
4k views

Sample vulnerable web apps to test Pentesting platforms [closed]

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
user974896's user avatar
48 votes
5 answers
8k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
atdre's user avatar
  • 19.1k
20 votes
3 answers
27k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
Eduardo Cereto's user avatar
19 votes
4 answers
10k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
AviD's user avatar
  • 73.3k
16 votes
4 answers
14k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
franz1's user avatar
  • 481
13 votes
2 answers
94k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
Pamela's user avatar
  • 315
12 votes
4 answers
9k views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
smilebomb's user avatar
  • 301
12 votes
4 answers
3k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
Mohamad Alhamoud's user avatar
11 votes
4 answers
2k views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
pr-'s user avatar
  • 792
11 votes
4 answers
2k views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
makerofthings7's user avatar
9 votes
3 answers
3k views

Is there a best practice to handle vulnerability scanning attempts?

We've found a number of attempts to access non-existent pages in our IIS logs, specifically a lot of variations on phpMyAdmin URLs. My kneejerk reaction would be to block these IPs, but I have a ...
JNK's user avatar
  • 193
8 votes
3 answers
419 views

Does concealing server software versions have a notable effect on security?

Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
sharptooth's user avatar
  • 2,241
8 votes
7 answers
33k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
Harikrishnan's user avatar
8 votes
6 answers
1k views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
Sonny Ordell's user avatar
  • 3,566
7 votes
2 answers
399 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
End Anti-Semitic Hate's user avatar
6 votes
2 answers
4k views

False positives in OpenVAS

I recently ran the 1st vulnerability scan in my offices network using OpenVAS. We received a great deal of false positives. Mostly I saw that (at least some) tests are unaware of internal patches in a ...
Uberhumus's user avatar
  • 198
6 votes
1 answer
6k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
atdre's user avatar
  • 19.1k
5 votes
1 answer
7k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] 80/...
flydev's user avatar
  • 153
4 votes
3 answers
9k views

How to figure out which open ports or services are insecure?

We have around one thousand machines on internet. We do port scanning with nmap, and find many ports open on these machines. Sometime we found administrative website using HTTP instead of HTTPS, we ...
user15580's user avatar
  • 777
2 votes
3 answers
3k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
justtrying123's user avatar
2 votes
2 answers
2k views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
Michael's user avatar
  • 1,469
2 votes
2 answers
3k views

Vulnerability scanner tools to use with Snort

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
pnp's user avatar
  • 1,808
1 vote
2 answers
7k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
P3nT3ster's user avatar
  • 867
0 votes
1 answer
20k views

How to fix Path Disclosure Vulnerability?

I have run a Qualys Web Application Scan for a customer website and found the "Path Disclosure Path-Based Vulnerability". If the normal URL is like this http://example.com/ When I go to the URL http:/...
BR.Hamza's user avatar
  • 117