Skip to main content
14 votes
Accepted

Security scan result - Server leaks inodes via ETags

First of all, this is a false positive. Nikto reports this issue "Server leaks inodes via ETags" if there is a dash in the ETag header, which is by itself not an indication of anything. An inode is a ...
Sjoerd's user avatar
  • 34.4k
4 votes

QR Code Security Testing

How can I test QR Codes on security issues? The QR code is just a piece of data. It's no different from a bar code - or a text string. It encodes data. Your question is essentially meaningless, as ...
vidarlo's user avatar
  • 17.6k
4 votes
Accepted

How to test for NoSQL injections?

A very-basic NoSQL injection can be studied here -- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_sql_and_nosql_injection.html -- which is available from your testing ...
atdre's user avatar
  • 19.1k
3 votes

What is dynamic code analysis? Is it the same as DAST?

SAST is more than just scanning code. I'd consider scanning dependency lists/files or inspecting containers and hosts to be a form of static analysis. Anything that doesn't require executing and ...
Thomas Owens's user avatar
  • 1,142
2 votes

Continuous SQL injection testing

You could script up example based testing pretty easily. With a sample request, sqlmap can do the rest. The only thing it doesnt do by default I believe is path paramters, but that as well could be ...
joe's user avatar
  • 602
2 votes
Accepted

How to check/test security issues of freeware?

Almost the same thing as what can be done for paid softwares: examine the reputation of the vendor/software, and evaluate the risk in adding it to white list against the cost of forbidding it. For ...
Serge Ballesta's user avatar
2 votes

How to test the security of a hardened Web Browser?

If you want to test the sandbox capabilities you need something like a real exploit which will try to do something an attacker would do. But I think it is not really possible for you to get a exploit ...
40F4's user avatar
  • 922
2 votes

Which tool to use to automate REST API pentest

For ZAP you can either use the API packaged scan https://www.zaproxy.org/docs/docker/api-scan/ (which runs in Docker & has a GitHub action) or a custom Automation Framework plan https://www....
Simon Bennetts's user avatar
1 vote
Accepted

Not able to see server response when making request using python

Based on the information you've provided, it seems that the issue is not with your code, but rather with the way Burp is configured. It appears that Burp is not intercepting the response from the ...
Hooman.AS's user avatar
1 vote

What is dynamic code analysis? Is it the same as DAST?

Yes. Dynamic Code Analysis is same with DAST. Check the following checkpoint web page: What is Dynamic Code Analysis? Dynamic code analysis – also called Dynamic Application Security Testing (DAST) – ...
Hasan's user avatar
  • 529
1 vote

Auto-login to refresh token in Burp Suite 2

I also faced the same issue with Angular (OAuth) multi page login has the login issues with one of the web app I was testing so I came up with a burp multi extension solution. If you are interested, ...
Vinay's user avatar
  • 11
1 vote
Accepted

Continuous SQL injection testing

I would like to look at this problem from a different point of view. You've said that you found many SQLIs in different API endpoints in your application. What exactly was the fix/mitigation for ...
shawkyz1's user avatar
  • 126
1 vote

Continuous SQL injection testing

Interesting question! You will need to automate multiple processes for this to work. There is no magic product (which I know of) that does this, but here is an algorithm: Gather info about web ...
AK_'s user avatar
  • 687
1 vote

Using Selenium to automate data entry

I would not use Selenium as there is an entire class of scripts called Grease Monkey scripts that automate repetitive user task. See TamperMonkey for one of many examples.
sevensevens's user avatar
1 vote

Criteria for selecting fields and network protocols for fuzzing

I think you're going to often find that your criteria is constrained by several factors, which actually limit what you can test. The tools you have access to, and the licences you're operating under (...
Daisetsu's user avatar
  • 5,160
1 vote

Can I perform a local test for DNS leaking?

DNSleak inspects DNS packets on the local network interface to detect leaks. Unlike web-based solutions, it works at the local computer level. No third party servers are used and DNS leak result is a ...
lofidevops's user avatar
  • 3,610
1 vote

Automated Malware Analysis Tools as a standalone

Perhaps you can try Limon sandbox. (for Linux malware) https://github.com/monnappa22/Limon
Jeremy's user avatar
  • 113
1 vote

CentOS for security testing?

If you are working in a corporate environment, it is best to stick to the tools and OS that are supported by the IT department. Since their main concern seems to be stability with even Ubuntu being "...
SeeYouInDisneyland's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible