Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

Filter by
Sorted by
Tagged with
122 votes
8 answers
9k views

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:...
hsnm's user avatar
  • 1,291
48 votes
5 answers
8k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
atdre's user avatar
  • 19.1k
33 votes
8 answers
9k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
SaAtomic's user avatar
  • 1,019
31 votes
5 answers
7k views

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

I'm reading a white hat hacking book from a famous certification. They say the methodology for hacking a web server is: information gathering (domain name, DNS, IP, etc.) footprinting (ex: banner ...
botanga's user avatar
  • 447
27 votes
1 answer
3k views

What questions should be asked when joining a new security team? [closed]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
bobmagoo's user avatar
  • 434
26 votes
4 answers
50k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
blong's user avatar
  • 369
25 votes
3 answers
8k views

Should I report a security vulnerability?

I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?
Polaris Alderson's user avatar
25 votes
4 answers
4k views

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

Say, I have scanned our Cisco Router, and it returned 20 vulnerabilities back. However, most of them are tied to specific services that this router is not running, for example CVE-2016-6380 - we are ...
shivelin's user avatar
  • 458
24 votes
3 answers
5k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
21 votes
6 answers
70k views

Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
Sonny Ordell's user avatar
  • 3,566
21 votes
4 answers
53k views

How can you check and analyze SSL ports other than 443?

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
Chloe's user avatar
  • 1,758
20 votes
3 answers
27k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
Eduardo Cereto's user avatar
19 votes
2 answers
123k views

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the ...
J. Caballero's user avatar
19 votes
4 answers
10k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
AviD's user avatar
  • 73.3k
16 votes
4 answers
14k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
franz1's user avatar
  • 481
16 votes
2 answers
2k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
AviD's user avatar
  • 73.3k
14 votes
1 answer
19k views

How to detect suspicious content in a TrueType Font (.ttf) font file

I got curious about how to scan or assess the risk of a particular font file before deploying it to hosts. First line of defense, of course, is to make sure that our hosts are patched against any ...
mcgyver5's user avatar
  • 6,864
13 votes
2 answers
94k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
Pamela's user avatar
  • 315
13 votes
3 answers
4k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
TheRookierLearner's user avatar
12 votes
2 answers
4k views

How do hackers search for vulnerabilities on certain ports? [closed]

Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.
ghost ghoster's user avatar
12 votes
2 answers
6k views

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

Performed credentialed vulnerability scan on Linux/Unix servers with Nessus and thousands of vulnerabilities are found on port tcp/0. How could an IANA reserved port (tcp/0) handle traffic? Are those ...
Shakir's user avatar
  • 185
12 votes
4 answers
3k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
Mohamad Alhamoud's user avatar
12 votes
4 answers
9k views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
smilebomb's user avatar
  • 301
12 votes
3 answers
5k views

Any tool for scanning vulnerabilities in browser extensions? [closed]

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
TheRookierLearner's user avatar
11 votes
4 answers
9k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
Josh P's user avatar
  • 213
11 votes
4 answers
2k views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
makerofthings7's user avatar
11 votes
3 answers
6k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
Magnus's user avatar
  • 1,204
11 votes
6 answers
9k views

Whats the probability of a personal computer being hacked?

For a normal computer user following these practices: Have an up to date anti-virus with a firewall installed (Norton). Do not install cracked software. Do not open suspicious links or download ...
user avatar
11 votes
2 answers
1k views

How can a network observer identify computers running old versions of Java?

I received an email earlier today from my ISP (a university). The email reads (in part): Your network connection has been disabled because your version of Java is not patched for the most recent ...
Tom Marthenal's user avatar
11 votes
2 answers
6k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
D.W.'s user avatar
  • 99.6k
11 votes
4 answers
2k views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
pr-'s user avatar
  • 792
11 votes
1 answer
678 views

Did DARPA's Cyber Grand Challenge winner actually discover previously unknown vulnerabilities?

DARPA announced a winner on August 4, 2016 of its Cyber Grand Challenge DARPA Cyber Grand Challenge. The contest was described as designed to accelerate the development of advanced, autonomous ...
Dalton Bentley's user avatar
10 votes
4 answers
3k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
Legolas's user avatar
  • 563
10 votes
1 answer
7k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
user619818's user avatar
10 votes
2 answers
18k views

How do vulnerability scanners detect when DEBUG is set to True on ASP.NET applications

I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this. I've ...
David Stratton's user avatar
10 votes
1 answer
7k views

How to Perform Vulnerability Assessment for WCF services

Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
P3nT3ster's user avatar
  • 867
9 votes
3 answers
3k views

Is there a best practice to handle vulnerability scanning attempts?

We've found a number of attempts to access non-existent pages in our IIS logs, specifically a lot of variations on phpMyAdmin URLs. My kneejerk reaction would be to block these IPs, but I have a ...
JNK's user avatar
  • 193
9 votes
3 answers
389 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
smiley's user avatar
  • 1,204
9 votes
3 answers
2k views

Building list of vulnerabilities that should be verified during pentest

I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices. People often mention that it is a good idea to gather intelligence and enumerate ...
Eugene Loy's user avatar
9 votes
2 answers
290 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
michaelg's user avatar
8 votes
7 answers
33k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
Harikrishnan's user avatar
8 votes
6 answers
1k views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
Sonny Ordell's user avatar
  • 3,566
8 votes
3 answers
419 views

Does concealing server software versions have a notable effect on security?

Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
sharptooth's user avatar
  • 2,241
8 votes
2 answers
13k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
PeeHaa's user avatar
  • 599
8 votes
1 answer
349 views

Is it dangerous "Powered by..." tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
KDEx's user avatar
  • 5,019
8 votes
1 answer
3k views

Malformed HTTP requests with repeated protocol (GET /https://https://www.DOMAIN.com) in Apache logs - what vulnerability are they scanning for?

About once per day, I'm seeing the following series of requests in my Apache 2.4 httpd logs, and I'm trying to figure out what vulnerability is being scanned for. Each occurrence of these scans has an ...
Parker's user avatar
  • 400
7 votes
3 answers
689 views

Which resources can help me learn how to use metasploit? [closed]

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
wizztjh's user avatar
  • 181
7 votes
8 answers
988 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
Jeff's user avatar
  • 953
7 votes
4 answers
5k views

implications of incomplete TCP handshake session

In network security, why do we care about knowing incomplete TCP handshake sessions? Is there a security implication behind this?
steve's user avatar
  • 85
7 votes
2 answers
399 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
End Anti-Semitic Hate's user avatar

1
2 3 4 5
9