Questions tagged [web-scanners]

A web application security scanner performs a black box test on a web application to identify potential security vulnerabilities and architectural weaknesses in the web application.

Filter by
Sorted by
Tagged with
63
votes
16answers
56k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
34
votes
4answers
7k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
45
votes
3answers
13k views

How does the attacker discover our server? [duplicate]

As titled, we discovered some unknown IP address is accessing our API Server. We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app. However, our ...
20
votes
5answers
5k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
9
votes
3answers
7k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&...
15
votes
4answers
17k views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for normal http requests. It resets the connection for ...
4
votes
3answers
31k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
2
votes
2answers
751 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
2
votes
3answers
715 views

How to defend against web server security scanners? [closed]

I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like: /CFIDE/administrator/ and ...
1
vote
3answers
5k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?