Questions tagged [web-scanners]

A web application security scanner performs a black box test on a web application to identify potential security vulnerabilities and architectural weaknesses in the web application.

63
votes
16answers
56k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
45
votes
3answers
13k views

How does the attacker discover our server? [duplicate]

As titled, we discovered some unknown IP address is accessing our API Server. We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app. However, our ...
33
votes
4answers
7k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
20
votes
5answers
5k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
16
votes
3answers
879 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
16
votes
3answers
2k views

Can anyone recognise this sudden influx of malformed HTTP requests?

Starting around 3 weeks ago, my site started getting a lot of strange and recurring http requests from my users. I'm familiar with malicious scans which happen on a daily basis, but these requests ...
15
votes
4answers
17k views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for normal http requests. It resets the connection for ...
9
votes
3answers
7k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&...
9
votes
2answers
324 views

Given a vulnerable JavaScript snippet from a Stack Overflow answer, how can I cheaply find websites whose authors have copied and pasted it?

Frequently, Stack Overflow answers to JavaScript questions contain XSS vulnerabilities (or vulnerabilities of other kinds). For instance, this answer with 420 upvotes and a quarter of a million views ...
8
votes
3answers
9k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
6
votes
1answer
4k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...
5
votes
2answers
4k views

Preventing Attacks Scanning for PHPMyAdmin etc

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this: 190.196.161.110 - - [16/Oct/2011:23:37:...
5
votes
2answers
2k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
5
votes
1answer
784 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
5
votes
4answers
2k views

Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]

Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN? Question 2: Also, can data from intranet ...
5
votes
2answers
126 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
4
votes
2answers
902 views

How can I find the malicious/backdoor codes without knowing the last modified date?

Last night my website got hacked and attacker edited the main index.php. I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor ...
4
votes
2answers
893 views

IBM AppScan false positive

I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue. How is AppScan able to find vulnerabilities while I ...
4
votes
3answers
248 views

Scan for common web applications?

Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and ...
4
votes
3answers
31k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
4
votes
1answer
247 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
4
votes
2answers
4k views

Do you know any crawler/spider software, which is able to go through an ASP.NET site?

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
4
votes
1answer
210 views

Services Like McAfee Secure

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
4
votes
1answer
280 views

Why would an attacker include a request body with an HTTP GET request?

I have a website that does not run PHP (management decision) or has wordpress installed. Intermittently, I receive a few requests for wp_login pages that trip my IDS. The requests are served with a ...
3
votes
5answers
380 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
3
votes
3answers
2k views

Self Tests for cPanel Server PCI Compliance

(Edited & added more information at the bottom of this question) I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
3
votes
2answers
3k views

How to Estimate time taken for Web Application Security Testing?

I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10 Based on my understanding, ...
3
votes
3answers
197 views

Trying to identify what a scanner was looking for

I got scanned yesterday, and I'm seeing a bunch of entries in my logs like /'\"\\'\\\");|]*{%0d%0a<%00>/photos or /'\"\\'\\\");|]*{%0d%0a<%00>/resources. What specific vulnerability was ...
2
votes
3answers
22k views

How to exploit this SQL injection vulnerability?

I am learning SQL injection on a vulnerable web app. I scanned it with w3af. It showed many vulnerabilities. One of them is: SQL injection in a Microsoft SQL database was found at: "http://www....
2
votes
5answers
4k views

Website vulnerability scanner in Java && Open Source [closed]

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
2
votes
2answers
749 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
2
votes
1answer
4k views

Nikto authentication

I am trying to complete a war game on Hell Bound Hackers. I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, ...
2
votes
3answers
704 views

How to defend against web server security scanners? [closed]

I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like: /CFIDE/administrator/ and ...
2
votes
2answers
328 views

Strange requests to my server

I recently checked my logs and found some strange requests to my server. eg GET /path/Microsoft.XMLHTTP HTTP/1.0 GET /path2/Scripting.FileSystemObject HTTP/1.0 A further check seems to point to some ...
2
votes
1answer
2k views

Why is “MIME type mismatch on image file” a security vulnerability?

Some security vulnerability scanners as Ratproxy detects a vulnerability called "MIME type mismatch on image file". Thanks to the CAPEC project we can see that Cross-Site Scripting Using MIME Type ...
2
votes
2answers
1k views

Looking for open source crawler/spider & scanner [closed]

Until now I managed to look into Webscarab, Webscarab-NG, IronWASP & Burp extender. Unfortunately, except IronWASP, that refused to compile from the GIT source, none of the projects matched my ...
2
votes
3answers
12k views

Can you export a report from OWASP ZAP based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
376 views

Nikto: this might be interesting… file redirects

What does Nikto's "this could be interesting" log mean? It identified a file (say, admin.html) as potentially interesting. However, when I wget or attempt to access this file in a browser, it just ...
2
votes
2answers
396 views

Detect a Host on my Network that is Conducting Web Scraping on External Systems

It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, ...
2
votes
4answers
6k views

Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule

I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate. tl;dr: The following rule in my .htaccess is causing Sucuri's free online scanner to ...
2
votes
2answers
2k views

Malware removal: Iframe injected javascript

My Joomla! website is infected by an iframe injected malware, according to Sucuri SiteCheck: To remove the malware, does it suffice to remove the infected file site/media/system/js/caption.js? Or ...
2
votes
1answer
1k views

Automated tools to test Struts OGNL security vulnerabilities

I'm looking for a way to find Struts2 OGNL vulnerabilities (specifically http://www.cvedetails.com/cve/CVE-2013-4316/ and http://www.cvedetails.com/cve/CVE-2013-2251/. ) I know that attackers ...
2
votes
1answer
307 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
2
votes
0answers
67 views

Smart web spider? [closed]

When testing a web app, I often start with spidering the app in order to get an idea of the structure of the app. What bothers me with that approach is that thal all spidering tools that I tried are ...
2
votes
0answers
62 views

Burp warning whenever I write a rule? [closed]

Whenever I write rule and save it in burp it gives this warning, I am not able to find out why it warns me The rule is not in-scope for any URLs. Are you sure yu want to proceed? While the rule is ...
1
vote
3answers
5k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
1
vote
3answers
486 views

What is the first step in auditing the security efficiency of a simple website?

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security. I am wondering from where to start? Is there a famous audit forms to analyze and ...
1
vote
2answers
896 views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
1
vote
1answer
1k views

Was my phpMyAdmin hacked?

On a server of mine I have a current version of phpMyAdmin running. Unfortunately (my bad I knew I had to delete this folder for security after installation, I simply forgot... dangit) I still had the ...
1
vote
2answers
3k views

Credentialed scans and the Burp Suite active Scanner

I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...