Skip to main content
61 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
Marcus Müller's user avatar
60 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

You have several assumptions here: scanners can find all vulnerabilities if a scanner cannot find a vulnerability then there are no vulnerabilities all manual tasks can be automated attackers would ...
schroeder's user avatar
  • 131k
46 votes

Should I report a security vulnerability?

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that ...
Conor Mancone's user avatar
41 votes
Accepted

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated scanning tools are fairly crude, and don't tend to take that kind of nuance into account - the scanner is most likely flagging any HTTP response that doesn't have the Content-Type header, ...
Gh0stFish's user avatar
  • 13k
40 votes

Should I report a security vulnerability?

Rule one of vulnerability scanning or any other activity that could possibly be interpreted as hostile: get permission in writing signed by senior management first. An unsolicited "vulnerability scan" ...
Gaius's user avatar
  • 808
32 votes
Accepted

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
Tom K.'s user avatar
  • 7,991
28 votes

Giving malicious crawlers and scripts a hard time

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
Dmitry Grigoryev's user avatar
23 votes

How do hackers search for vulnerabilities on certain ports?

Basically some tools (like nmap) try to open session over each port of a target. If the session is opened, the tool will try to dialog with the port in every way it knows (http, ftp, smtp, mysql, ...) ...
Sibwara's user avatar
  • 1,348
20 votes

Should I report a security vulnerability?

Do you want to be a white-hat or black-hat? The answer may also depend on what laws apply based on what country you are in, what country the company is in. Things that are always ok Use a ...
Mike Ounsworth's user avatar
18 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
ximaera's user avatar
  • 3,486
17 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

DAST tools have several limitations that need to be addressed through manual inspection of the application: They cannot find business logic flaws, because they do not understand the use cases and ...
Demento's user avatar
  • 7,495
16 votes

Giving malicious crawlers and scripts a hard time

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and ...
pineappleman's user avatar
  • 2,299
13 votes
Accepted

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

This isn't vulnerable to XSS since the Content-Type is set to application/json and thus no Javascript will be executed by all major modern browsers. If you do some fancy Javascript stuff with the JSON ...
layton's user avatar
  • 146
12 votes

Giving malicious crawlers and scripts a hard time

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few ...
kubanczyk's user avatar
  • 1,192
12 votes

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated security scans are notoriously prone to false positives. In general I agree with the other answer to pick your battles with the security team. If a false finding can be "remediated"...
user3067860's user avatar
11 votes

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

An XSS vulnerability usually consists of two components: A backend which reflects user-provided strings without filtering them and a frontend which puts that input into a HTML document without ...
Philipp's user avatar
  • 49.4k
11 votes

How do hackers search for vulnerabilities on certain ports?

Tools like Metasploit can be used to automate this process. The tool scans the target host for open ports, then attempts to identify the services running on these ports, then attempts to exploit ...
mti2935's user avatar
  • 23.7k
10 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
mgjk's user avatar
  • 7,545
9 votes
Accepted

Human vs. Vulnerability Scanners

Most access control / authorization flaws would never be found by a (generic) tool, because it does not have the understanding of what is supposed to be accessible and what not. (Having said that, ...
Gabor Lengyel's user avatar
9 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

Here is a very recent topic that touches on the same issue: Why OpenVAS does not find all open ports compared to Nmap?. Takeaway: each tool is different, and may yield different results. Not to ...
Kate's user avatar
  • 8,435
8 votes

Did DARPA's Cyber Grand Challenge winner actually discover previously unknown vulnerabilities?

The DARPA test bed, CGC (Cyber Grand Challenge), was a modified Linux platfrom (DECREE). Its binaries (the compiled machined code for the system) contained only 7 system calls (e.g., terminate, ...
Dalton Bentley's user avatar
8 votes

How can you check and analyze SSL ports other than 443?

I use https://testssl.sh/ testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and ...
Colonel Panic's user avatar
8 votes
Accepted

Server getting probed: why can I see successful GET requests to other sites?

... GET /phpMyadmin_bak/index.php ... 404 ... These are requests which look for vulnerable installations of typical software (phpMyAdmin in this case). Nothing to worry about if you don't run such ...
Steffen Ullrich's user avatar
7 votes

implications of incomplete TCP handshake session

Many scanners which are used to detect open ports use incomplete or bad TCP handshakes. Sometimes they are also used in DDOS attacks, but if that were true you would have 100's to 1000's a second. ...
cybernard's user avatar
  • 538
7 votes

Source Code audit

For instance there was a vulnerability regarding strcpy... flawfinder does not report vulnerabilities. To cite from the description of the program: ... examines C/C++ source code and reports ...
Steffen Ullrich's user avatar
7 votes
Accepted

Checking if an arbitrary file exists on the server can be considered Path Traversal?

Here there are two different aspects. CWE-23 is called "Relative Path Traversal", not "Path Traversal". This is important. This description means the essence of the problem. See ...
mentallurg's user avatar
  • 12.5k
6 votes
Accepted

Is jQuery 2.1.1 vulnerable to OS command injection?

It's a false positive. In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is: root:function(a){return a===o} This is obviously not ...
tim's user avatar
  • 29.7k
6 votes

Giving malicious crawlers and scripts a hard time

This is a topic near and dear to my heart, I've battled bots etc for ages. My conclusion is that your best strategy always, though not very gratifying, is to simply absorb the traffic, that is, detect ...
Lizardx's user avatar
  • 161
6 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low ...
TheJulyPlot's user avatar
  • 7,829

Only top scored, non community-wiki answers of a minimum length are eligible