62 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

You have several assumptions here: scanners can find all vulnerabilities if a scanner cannot find a vulnerability then there are no vulnerabilities all manual tasks can be automated attackers would ...
user avatar
  • 123k
60 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
user avatar
46 votes

Should I report a security vulnerability?

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that ...
user avatar
41 votes

Should I report a security vulnerability?

Rule one of vulnerability scanning or any other activity that could possibly be interpreted as hostile: get permission in writing signed by senior management first. An unsolicited "vulnerability scan" ...
user avatar
  • 820
40 votes
Accepted

What questions should be asked when joining a new security team?

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge ...
user avatar
35 votes
Accepted

Open-source penetration-test automation

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (...
user avatar
  • 18.9k
32 votes
Accepted

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
user avatar
  • 7,913
28 votes
Accepted

Can I block viruses from a USB stick by scanning it before opening its folder?

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very ...
user avatar
28 votes

Giving malicious crawlers and scripts a hard time

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
user avatar
24 votes

How do hackers search for vulnerabilities on certain ports?

Basically some tools (like nmap) try to open session over each port of a target. If the session is opened, the tool will try to dialog with the port in every way it knows (http, ftp, smtp, mysql, ...) ...
user avatar
  • 1,336
20 votes
Accepted

Is there a best practice to handle vulnerability scanning attempts?

I ignore them. There will always be compromised systems continually scanning the entire Internet for arbitrary vulnerabilities. Trying to block them is no more effective than spitting into the wind....
user avatar
  • 35.4k
20 votes

Should I report a security vulnerability?

Do you want to be a white-hat or black-hat? The answer may also depend on what laws apply based on what country you are in, what country the company is in. Things that are always ok Use a ...
user avatar
17 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
user avatar
  • 3,445
17 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

DAST tools have several limitations that need to be addressed through manual inspection of the application: They cannot find business logic flaws, because they do not understand the use cases and ...
user avatar
  • 7,204
16 votes
Accepted

How can you check and analyze SSL ports other than 443?

2021-02-28 Update: GeoCerts and SSLPing Two new entries on the list. They've been around for a while. Both of these can do ports other than 443: https://www.geocerts.com/ssl-checker https://sslping....
user avatar
16 votes

Giving malicious crawlers and scripts a hard time

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and ...
user avatar
  • 2,249
12 votes

Giving malicious crawlers and scripts a hard time

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few ...
user avatar
  • 1,182
12 votes

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

An XSS vulnerability usually consists of two components: A backend which reflects user-provided strings without filtering them and a frontend which puts that input into a HTML document without ...
user avatar
  • 48.8k
11 votes

Nikto authentication

I actually went ahead and checked out your challenge and noticed that it required the cookie fusion_user for loading up the challenge. This can be confirmed from the BurpSuite Screenshot I have posted ...
user avatar
11 votes
Accepted

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

This isn't vulnerable to XSS since the Content-Type is set to application/json and thus no Javascript will be executed by all major modern browsers. If you do some fancy Javascript stuff with the JSON ...
user avatar
  • 126
11 votes

How do hackers search for vulnerabilities on certain ports?

Tools like Metasploit can be used to automate this process. The tool scans the target host for open ports, then attempts to identify the services running on these ports, then attempts to exploit ...
user avatar
  • 19.5k
10 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
user avatar
  • 7,535
10 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

Here is a very recent topic that touches on the same issue: Why OpenVAS does not find all open ports compared to Nmap?. Takeaway: each tool is different, and may yield different results. Not to ...
user avatar
  • 6,462
9 votes

How can you check and analyze SSL ports other than 443?

I use https://testssl.sh/ testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and ...
user avatar
9 votes
Accepted

Human vs. Vulnerability Scanners

Most access control / authorization flaws would never be found by a (generic) tool, because it does not have the understanding of what is supposed to be accessible and what not. (Having said that, ...
user avatar
8 votes
Accepted

How does this shellshock scan work?

If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT. bash would look at all environment variables starting with () { to ...
user avatar
  • 5,382
8 votes

How to decode this exploit scanner?

It's not scanning for the "shellshock" exploit. It's scanning for an older exploit where a poorly-configured server leaves a copy of the PHP interpreter in the CGI directory, permitting remote ...
user avatar
  • 34.4k
8 votes

Difference between hardening guides (CIS, NSA, DISA)

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission ...
user avatar
8 votes
Accepted

The effect of hidden or spoofed service banners on vulnerability scanners

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers). ...
user avatar
  • 60.6k

Only top scored, non community-wiki answers of a minimum length are eligible