61 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
Marcus Müller's user avatar
61 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

You have several assumptions here: scanners can find all vulnerabilities if a scanner cannot find a vulnerability then there are no vulnerabilities all manual tasks can be automated attackers would ...
schroeder's user avatar
  • 129k
46 votes

Should I report a security vulnerability?

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that ...
Conor Mancone's user avatar
42 votes
Accepted

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated scanning tools are fairly crude, and don't tend to take that kind of nuance into account - the scanner is most likely flagging any HTTP response that doesn't have the Content-Type header, ...
Gh0stFish's user avatar
  • 10.1k
41 votes

Should I report a security vulnerability?

Rule one of vulnerability scanning or any other activity that could possibly be interpreted as hostile: get permission in writing signed by senior management first. An unsolicited "vulnerability scan" ...
Gaius's user avatar
  • 818
32 votes
Accepted

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
Tom K.'s user avatar
  • 7,975
28 votes
Accepted

Can I block viruses from a USB stick by scanning it before opening its folder?

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very ...
WorseDoughnut's user avatar
28 votes

Giving malicious crawlers and scripts a hard time

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
Dmitry Grigoryev's user avatar
24 votes

How do hackers search for vulnerabilities on certain ports?

Basically some tools (like nmap) try to open session over each port of a target. If the session is opened, the tool will try to dialog with the port in every way it knows (http, ftp, smtp, mysql, ...) ...
Sibwara's user avatar
  • 1,338
20 votes

Should I report a security vulnerability?

Do you want to be a white-hat or black-hat? The answer may also depend on what laws apply based on what country you are in, what country the company is in. Things that are always ok Use a ...
Mike Ounsworth's user avatar
18 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
ximaera's user avatar
  • 3,466
17 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

DAST tools have several limitations that need to be addressed through manual inspection of the application: They cannot find business logic flaws, because they do not understand the use cases and ...
Demento's user avatar
  • 7,465
16 votes

Giving malicious crawlers and scripts a hard time

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and ...
pineappleman's user avatar
  • 2,299
12 votes

Giving malicious crawlers and scripts a hard time

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few ...
kubanczyk's user avatar
  • 1,192
12 votes
Accepted

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

This isn't vulnerable to XSS since the Content-Type is set to application/json and thus no Javascript will be executed by all major modern browsers. If you do some fancy Javascript stuff with the JSON ...
layton's user avatar
  • 136
11 votes

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

An XSS vulnerability usually consists of two components: A backend which reflects user-provided strings without filtering them and a frontend which puts that input into a HTML document without ...
Philipp's user avatar
  • 49.4k
11 votes

How do hackers search for vulnerabilities on certain ports?

Tools like Metasploit can be used to automate this process. The tool scans the target host for open ports, then attempts to identify the services running on these ports, then attempts to exploit ...
mti2935's user avatar
  • 23.1k
11 votes

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Automated security scans are notoriously prone to false positives. In general I agree with the other answer to pick your battles with the security team. If a false finding can be "remediated"...
user3067860's user avatar
10 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
mgjk's user avatar
  • 7,525
10 votes

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

Here is a very recent topic that touches on the same issue: Why OpenVAS does not find all open ports compared to Nmap?. Takeaway: each tool is different, and may yield different results. Not to ...
Kate's user avatar
  • 7,927
9 votes
Accepted

Human vs. Vulnerability Scanners

Most access control / authorization flaws would never be found by a (generic) tool, because it does not have the understanding of what is supposed to be accessible and what not. (Having said that, ...
Gabor Lengyel's user avatar
8 votes

How can you check and analyze SSL ports other than 443?

I use https://testssl.sh/ testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and ...
Colonel Panic's user avatar
8 votes
Accepted

Any way to browse OSVDB?

As of today (April 5th, 2016) The project was shut down due to lack of contribution, and there is no plan for it to return. As of today, a decision has been made to shut down the Open Sourced ...
smilebomb's user avatar
  • 301
8 votes

Did DARPA's Cyber Grand Challenge winner actually discover previously unknown vulnerabilities?

The DARPA test bed, CGC (Cyber Grand Challenge), was a modified Linux platfrom (DECREE). Its binaries (the compiled machined code for the system) contained only 7 system calls (e.g., terminate, ...
Dalton Bentley's user avatar
8 votes
Accepted

Server getting probed: why can I see successful GET requests to other sites?

... GET /phpMyadmin_bak/index.php ... 404 ... These are requests which look for vulnerable installations of typical software (phpMyAdmin in this case). Nothing to worry about if you don't run such ...
Steffen Ullrich's user avatar
7 votes

Virus-total offline Alternatives

The alternative is to buy all the AV which are used in virustotal.com and build a similar system for local use. Don't forget to cut it from the internet because AV might phone home not only to get new ...
Steffen Ullrich's user avatar
7 votes

implications of incomplete TCP handshake session

Many scanners which are used to detect open ports use incomplete or bad TCP handshakes. Sometimes they are also used in DDOS attacks, but if that were true you would have 100's to 1000's a second. ...
cybernard's user avatar
  • 538
7 votes

Source Code audit

For instance there was a vulnerability regarding strcpy... flawfinder does not report vulnerabilities. To cite from the description of the program: ... examines C/C++ source code and reports ...
Steffen Ullrich's user avatar
7 votes
Accepted

Checking if an arbitrary file exists on the server can be considered Path Traversal?

Here there are two different aspects. CWE-23 is called "Relative Path Traversal", not "Path Traversal". This is important. This description means the essence of the problem. See ...
mentallurg's user avatar
  • 12.3k

Only top scored, non community-wiki answers of a minimum length are eligible