Questions tagged [web-scanners]

A web application security scanner performs a black box test on a web application to identify potential security vulnerabilities and architectural weaknesses in the web application.

Filter by
Sorted by
Tagged with
0 votes
1 answer
94 views

ZAP authenticated scan without locking out the test user

I'm trying to set up an authenticated scan for a webapp, lets say admin.example.com. The authentication is done by a different service login.example.com through a JSON AJAX call. After successful ...
Richard Leonard Kirner's user avatar
0 votes
0 answers
190 views

Using Nikto to scan for default credentials on Tomcat

I am practicing initial access & privilege escalation using legacy vulnerabilities, particularly the RCE vulnerability on the Tomcat Manager. I have been trying to use Nikto to first scan the ...
toothlessgibbon's user avatar
1 vote
1 answer
89 views

How do you de-duplicate security risk findings obtained from various different tools?

You potentially use a variety of scanners and processes (e.g. Threat Modelling) which produces a set of overlapping outputs. How do you avoid repeated findings which are duplicated across toolsets?
transcend3nt's user avatar
0 votes
0 answers
88 views

How to find out what payloads are being uploaded when I am running a scan of remote website?

I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system. However, my system is connected to a remote VPS via VPN, ...
Shy's user avatar
  • 121
0 votes
0 answers
517 views

unable to pass recaptcha test using burpsuite proxy

when I open the burpsuite proxy, it kept hit me with recaptcha , after I click submit, another one pop up, and another, and another, and so on what is wrong?
bang_jagoet's user avatar
-3 votes
1 answer
752 views

How to choose a web path scanner? [closed]

There are many tools designed to brute force directories and files in webservers, for example: https://tools.kali.org/web-applications/dirbuster https://github.com/maurosoria/dirsearch https://github....
frenkie's user avatar
  • 23
0 votes
1 answer
398 views

A single IP address hosts multiple domain at the same time. How do I scan a single domain using nmap or other tools?

Let's say an IP address hosts multiple domains, (example.com, example.net, example.org, etc.). How do I port scan a specific domain?
bang_jagoet's user avatar
0 votes
0 answers
399 views

How can you fingerprint a Django web app?

In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
Kyle Fennell's user avatar
0 votes
0 answers
27 views

Securing against scans [duplicate]

I have a VM which is exposed to the internet. I can see a lot of scans for /azenv.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and like in my server logs. How do I protect from these ...
JavaHead's user avatar
  • 103
2 votes
1 answer
152 views

Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?

I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
Scinerio's user avatar
0 votes
1 answer
238 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
user8348136's user avatar
0 votes
1 answer
157 views

Got requests to unpublished services. Am I being spied on?

Just today I'm migrating some of my webpages to a new server. After a couple hours the services was ready, I set up a hosts file with my domain example.com pointing to the server address, went to my ...
Jassiel Díaz's user avatar
0 votes
1 answer
207 views

Nikto nocache option

I found an option -nocache : Disable response cache in here https://cirt.net/nikto2-docs/options.html But when I tried it, I always get this error Unknown option: nocache
code-8's user avatar
  • 125
2 votes
0 answers
193 views

Where to run long automated scans? [closed]

I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
ChocolateOverflow's user avatar
-4 votes
1 answer
799 views

Pentesting: Active vs Passive Scan [closed]

I couldn't find answers to this question on this forum so I'm just gonna ask: What are Active Scans and Passive Scans? What are their differences? Please include in your answer(s): differences in ...
ChocolateOverflow's user avatar
0 votes
1 answer
226 views

Is there anywhere we can scan projects (PHP, JAVA...) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]

Virustotal is excellent in its field. Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
T.Todua's user avatar
  • 2,727
1 vote
1 answer
470 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
Suliman Al Ruz's user avatar
0 votes
2 answers
504 views

Over 100 scanner requests 5 min after domain registration

Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all requests, all are automated scanner ...
user avatar
1 vote
0 answers
537 views

Wordpress detect plugins when wpscan fails

I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
Dimitrios Desyllas's user avatar
2 votes
1 answer
2k views

Nikto: this might be interesting... file redirects

What does Nikto's "this could be interesting" log mean? It identified a file (say, admin.html) as potentially interesting. However, when I wget or attempt to access this file in a browser, it just ...
Daniel Paczuski Bak's user avatar
3 votes
2 answers
25k views

Nikto authentication

I am trying to complete a war game on Hell Bound Hackers. I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, and ...
user5623335's user avatar
9 votes
4 answers
8k views

Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]

Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN? Question 2: Also, can data from intranet ...
nptxzs's user avatar
  • 181
3 votes
2 answers
11k views

Most efficient way to scan for webservers

Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example). What would be the most efficient way ...
pzirkind's user avatar
  • 737
0 votes
3 answers
9k views

How to detect Selenium/webdriver browsing on my site [closed]

I have a website and I notice a lot of bots traffic, I guess trying to extract data from the site. I managed to detect some traffics with scripts, or IP rate limits, but I see I can't detect access ...
Eyal H's user avatar
  • 101
1 vote
2 answers
393 views

Why is " Generic MIME used" a security vulnerability?

Some web application security scanners like Skipfish reports vulnerability "Generic MIME used". In my case this vulnerability was reported for resources like http://my_site/fonts/fontawesome-webfont....
user187205's user avatar
  • 1,293
2 votes
3 answers
2k views

How to defend against web server security scanners? [closed]

I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like: /CFIDE/administrator/ and ...
Click Ok's user avatar
  • 369
45 votes
3 answers
14k views

How does the attacker discover our server? [duplicate]

As titled, we discovered some unknown IP address is accessing our API Server. We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app. However, our ...
King Chan's user avatar
  • 579
9 votes
2 answers
598 views

Given a vulnerable JavaScript snippet from a Stack Overflow answer, how can I cheaply find websites whose authors have copied and pasted it?

Frequently, Stack Overflow answers to JavaScript questions contain XSS vulnerabilities (or vulnerabilities of other kinds). For instance, this answer with 420 upvotes and a quarter of a million views ...
Mark Amery's user avatar
  • 1,817
1 vote
1 answer
77 views

Reason behind sending multiple probes when scanning?

I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
Hansi's user avatar
  • 85
2 votes
2 answers
635 views

Detect a Host on my Network that is Conducting Web Scraping on External Systems

It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, ...
Zane's user avatar
  • 73
4 votes
1 answer
533 views

Why would an attacker include a request body with an HTTP GET request?

I have a website that does not run PHP (management decision) or has wordpress installed. Intermittently, I receive a few requests for wp_login pages that trip my IDS. The requests are served with a ...
RedBaron's user avatar
  • 155
0 votes
2 answers
2k views

Security scan with, or without, IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
Bob Ortiz's user avatar
  • 6,661
2 votes
0 answers
112 views

Smart web spider? [closed]

When testing a web app, I often start with spidering the app in order to get an idea of the structure of the app. What bothers me with that approach is that thal all spidering tools that I tried are ...
pineappleman's user avatar
  • 2,299
1 vote
2 answers
2k views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
Othman's user avatar
  • 577
1 vote
1 answer
2k views

Was my phpMyAdmin hacked?

On a server of mine I have a current version of phpMyAdmin running. Unfortunately (my bad I knew I had to delete this folder for security after installation, I simply forgot... dangit) I still had the ...
Flatron's user avatar
  • 225
1 vote
1 answer
2k views

Vulnerability scanning of AngularJS web app fails due to '#' in url

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format http://domain....
Harikrishnan's user avatar
4 votes
2 answers
1k views

IBM AppScan false positive

I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue. How is AppScan able to find vulnerabilities while I ...
Newbie1's user avatar
  • 51
-2 votes
1 answer
148 views

Web Application Security Scanner Identification [duplicate]

We got following URLs in our access logs. No referrer. Chrome user agent. Looks like some security scanner is/was at work. Is it possible to identify it? Many urls have references to netsparker. / /'/...
Sameer Naik's user avatar
2 votes
2 answers
694 views

Strange requests to my server

I recently checked my logs and found some strange requests to my server. eg GET /path/Microsoft.XMLHTTP HTTP/1.0 GET /path2/Scripting.FileSystemObject HTTP/1.0 A further check seems to point to some ...
JinPangPang's user avatar
  • 1,951
1 vote
1 answer
174 views

Is it possible for web scanners to crawl and test pages simultaneously?

I've searched and read some articles about web application security scanners. I've found that almost all scanners at first crawl the application to find all pages (or states). And then after crawling ...
Muhamad Jafarnejad's user avatar
4 votes
2 answers
5k views

How to Estimate time taken for Web Application Security Testing?

I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10 Based on my understanding, ...
Karthikaravind's user avatar
1 vote
1 answer
2k views

Does it make sense to scan localhost site?

I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it ...
Alexander Kleinhans's user avatar
4 votes
1 answer
15k views

Configuring burp to use in proxy environment

My university internet connection runs behind proxy. Its host name is 192.168.1.103 and port no is 3128. How do I configure proxy in burp suite if I should enter above proxy setting in my Firefox ...
Manoj Varma's user avatar
1 vote
2 answers
7k views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
dorothy's user avatar
  • 725
2 votes
1 answer
11k views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
dorothy's user avatar
  • 725
34 votes
4 answers
10k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
user2738698's user avatar
5 votes
2 answers
173 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
fvaliquette's user avatar
1 vote
2 answers
5k views

Credentialed scans and the Burp Suite active Scanner

I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...
Bryan's user avatar
  • 61
4 votes
3 answers
41k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
Max Rumpf's user avatar
2 votes
0 answers
201 views

Burp warning whenever I write a rule? [closed]

Whenever I write rule and save it in burp it gives this warning, I am not able to find out why it warns me The rule is not in-scope for any URLs. Are you sure yu want to proceed? While the rule is ...
siddhu619's user avatar
  • 117