Questions tagged [web-scanners]
A web application security scanner performs a black box test on a web application to identify potential security vulnerabilities and architectural weaknesses in the web application.
94
questions
0
votes
1
answer
94
views
ZAP authenticated scan without locking out the test user
I'm trying to set up an authenticated scan for a webapp, lets say admin.example.com. The authentication is done by a different service login.example.com through a JSON AJAX call. After successful ...
0
votes
0
answers
190
views
Using Nikto to scan for default credentials on Tomcat
I am practicing initial access & privilege escalation using legacy vulnerabilities, particularly the RCE vulnerability on the Tomcat Manager.
I have been trying to use Nikto to first scan the ...
1
vote
1
answer
89
views
How do you de-duplicate security risk findings obtained from various different tools?
You potentially use a variety of scanners and processes (e.g. Threat Modelling) which produces a set of overlapping outputs. How do you avoid repeated findings which are duplicated across toolsets?
- 99
0
votes
0
answers
88
views
How to find out what payloads are being uploaded when I am running a scan of remote website?
I have been running an Acunetix vulnerability scan of a remote website (containing 50 subdomains). I am not doing anything else on this system.
However, my system is connected to a remote VPS via VPN, ...
- 121
0
votes
0
answers
517
views
unable to pass recaptcha test using burpsuite proxy
when I open the burpsuite proxy, it kept hit me with recaptcha , after I click submit, another one pop up, and another, and another, and so on what is wrong?
-3
votes
1
answer
752
views
How to choose a web path scanner? [closed]
There are many tools designed to brute force directories and files in webservers, for example:
https://tools.kali.org/web-applications/dirbuster
https://github.com/maurosoria/dirsearch
https://github....
- 23
0
votes
1
answer
398
views
A single IP address hosts multiple domain at the same time. How do I scan a single domain using nmap or other tools?
Let's say an IP address hosts multiple domains, (example.com, example.net, example.org, etc.). How do I port scan a specific domain?
0
votes
0
answers
399
views
How can you fingerprint a Django web app?
In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
- 941
0
votes
0
answers
27
views
Securing against scans [duplicate]
I have a VM which is exposed to the internet. I can see a lot of scans for /azenv.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and like in my server logs.
How do I protect from these ...
- 103
2
votes
1
answer
152
views
Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?
I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
- 23
0
votes
1
answer
238
views
What is the best way for OWASP Zap to handle Unique Fields and API Sequences?
First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
- 11
0
votes
1
answer
157
views
Got requests to unpublished services. Am I being spied on?
Just today I'm migrating some of my webpages to a new server. After a couple hours the services was ready, I set up a hosts file with my domain example.com pointing to the server address, went to my ...
0
votes
1
answer
207
views
Nikto nocache option
I found an option
-nocache : Disable response cache
in here
https://cirt.net/nikto2-docs/options.html
But when I tried it, I always get this error
Unknown option: nocache
- 125
2
votes
0
answers
193
views
Where to run long automated scans? [closed]
I'm trying to run some automated scans without stopping for long periods of time (each scan can take anywhere from 8 hours to 3 days). I currently don't have a PC I can leave running for many days ...
- 3,482
-4
votes
1
answer
799
views
Pentesting: Active vs Passive Scan [closed]
I couldn't find answers to this question on this forum so I'm just gonna ask:
What are Active Scans and Passive Scans? What are their differences?
Please include in your answer(s):
differences in ...
- 3,482
0
votes
1
answer
226
views
Is there anywhere we can scan projects (PHP, JAVA...) for vulnerabilities, like VirusTotal.com does (All-in-one)? [closed]
Virustotal is excellent in its field.
Does there exist any tool (or site) where we could upload (or that could be also an offline PC version) to test projects or websites (PHP, Java, whatever) for ...
- 2,727
1
vote
1
answer
470
views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
0
votes
2
answers
504
views
Over 100 scanner requests 5 min after domain registration
Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all requests, all are automated scanner ...
user182663
1
vote
0
answers
537
views
Wordpress detect plugins when wpscan fails
I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
2
votes
1
answer
2k
views
Nikto: this might be interesting... file redirects
What does Nikto's "this could be interesting" log mean?
It identified a file (say, admin.html) as potentially interesting. However, when I wget or attempt to access this file in a browser, it just ...
3
votes
2
answers
25k
views
Nikto authentication
I am trying to complete a war game on Hell Bound Hackers.
I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, and ...
- 715
9
votes
4
answers
8k
views
Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]
Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN?
Question 2: Also, can data from intranet ...
- 181
3
votes
2
answers
11k
views
Most efficient way to scan for webservers
Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example).
What would be the most efficient way ...
- 737
0
votes
3
answers
9k
views
How to detect Selenium/webdriver browsing on my site [closed]
I have a website and I notice a lot of bots traffic, I guess trying to extract data from the site.
I managed to detect some traffics with scripts, or IP rate limits, but I see I can't detect access ...
- 101
1
vote
2
answers
393
views
Why is " Generic MIME used" a security vulnerability?
Some web application security scanners like Skipfish reports vulnerability "Generic MIME used". In my case this vulnerability was reported for resources like http://my_site/fonts/fontawesome-webfont....
- 1,293
2
votes
3
answers
2k
views
How to defend against web server security scanners? [closed]
I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:
/CFIDE/administrator/
and
...
- 369
45
votes
3
answers
14k
views
How does the attacker discover our server? [duplicate]
As titled, we discovered some unknown IP address is accessing our API Server.
We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app.
However, our ...
- 579
9
votes
2
answers
598
views
Given a vulnerable JavaScript snippet from a Stack Overflow answer, how can I cheaply find websites whose authors have copied and pasted it?
Frequently, Stack Overflow answers to JavaScript questions contain XSS vulnerabilities (or vulnerabilities of other kinds). For instance, this answer with 420 upvotes and a quarter of a million views ...
- 1,817
1
vote
1
answer
77
views
Reason behind sending multiple probes when scanning?
I've read, that the ZMap creators recommend to send three probes for each (ip,port) tuple when scanning. Let's say, we scan port 443 port with a TCP SYN scan. One reason, I can imagine is packet loss. ...
- 85
2
votes
2
answers
635
views
Detect a Host on my Network that is Conducting Web Scraping on External Systems
It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, ...
- 73
4
votes
1
answer
533
views
Why would an attacker include a request body with an HTTP GET request?
I have a website that does not run PHP (management decision) or has wordpress installed. Intermittently, I receive a few requests for wp_login pages that trip my IDS. The requests are served with a ...
- 155
0
votes
2
answers
2k
views
Security scan with, or without, IP whitelisting in the firewall and isn't that introducing a weak point?
In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
- 6,661
2
votes
0
answers
112
views
Smart web spider? [closed]
When testing a web app, I often start with spidering the app in order to get an idea of the structure of the app.
What bothers me with that approach is that thal all spidering tools that I tried are ...
- 2,299
1
vote
2
answers
2k
views
Vulnerability scanning vs fuzzing a web application
In the context of web applications, is vulnerability scanning a form of fuzzing?
I was told it wasn't the case, but here's what I know:
Wikipedia defines fuzzing as "providing invalid, unexpected, ...
- 577
1
vote
1
answer
2k
views
Was my phpMyAdmin hacked?
On a server of mine I have a current version of phpMyAdmin running. Unfortunately (my bad I knew I had to delete this folder for security after installation, I simply forgot... dangit) I still had the ...
- 225
1
vote
1
answer
2k
views
Vulnerability scanning of AngularJS web app fails due to '#' in url
I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format
http://domain....
- 442
4
votes
2
answers
1k
views
IBM AppScan false positive
I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue.
How is AppScan able to find vulnerabilities while I ...
- 51
-2
votes
1
answer
148
views
Web Application Security Scanner Identification [duplicate]
We got following URLs in our access logs. No referrer. Chrome user agent. Looks like some security scanner is/was at work. Is it possible to identify it? Many urls have references to netsparker.
/
/'/...
- 117
2
votes
2
answers
694
views
Strange requests to my server
I recently checked my logs and found some strange requests to my server. eg
GET /path/Microsoft.XMLHTTP HTTP/1.0
GET /path2/Scripting.FileSystemObject HTTP/1.0
A further check seems to point to some ...
- 1,951
1
vote
1
answer
174
views
Is it possible for web scanners to crawl and test pages simultaneously?
I've searched and read some articles about web application security scanners. I've found that almost all scanners at first crawl the application to find all pages (or states). And then after crawling ...
4
votes
2
answers
5k
views
How to Estimate time taken for Web Application Security Testing?
I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10
Based on my understanding, ...
1
vote
1
answer
2k
views
Does it make sense to scan localhost site?
I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it ...
4
votes
1
answer
15k
views
Configuring burp to use in proxy environment
My university internet connection runs behind proxy. Its host name is 192.168.1.103 and port no is 3128. How do I configure proxy in burp suite if I should enter above proxy setting in my Firefox ...
- 43
1
vote
2
answers
7k
views
Source code disclosure vulnerability
I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
- 725
2
votes
1
answer
11k
views
Cross Domain Javascript security [duplicate]
I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion."
May I know how would an attacker exploit this type of ...
- 725
34
votes
4
answers
10k
views
Why am I getting strange HTTP requests for non-existing pages?
I am running a web server and watching what people request. I have been getting frequent traffic like:
GET /phph/php/ph.php HTTP/1.1
or
GET /mrmr/mrm/mr.php HTTP/1.1
Are these scans? Are the ...
- 849
5
votes
2
answers
173
views
Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?
When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)?
If differences ...
- 121
1
vote
2
answers
5k
views
Credentialed scans and the Burp Suite active Scanner
I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...
- 61
4
votes
3
answers
41k
views
Scan all possible files on server (Brute force Filenames)
I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to.
So it would try something like: example.com/a, example.com/b,...
- 43
2
votes
0
answers
201
views
Burp warning whenever I write a rule? [closed]
Whenever I write rule and save it in burp it gives this warning, I am not able to find out why it warns me
The rule is not in-scope for any URLs. Are you sure yu want to proceed?
While the rule is ...
- 117