118
votes
Accepted
How does the attacker discover our server?
The short answer is that many people are scanning everything most of the time.
Doing so was, some years back, considered impractical, but the combination of better networks, better tools better ...
- 3,630
33
votes
Accepted
Why am I getting strange HTTP requests for non-existing pages?
These types of spurious requests are very, very common. They are either looking to see if you are already compromised, or looking to get your server to throw an error to gather info about your server (...
- 123k
15
votes
Accepted
nginx - How to prevent processing requests with undefined server names with HTTPS
I've solved it by generating a fake certificate that doesn't reveal domain name and adding it as a default one on the start of the config:
server {
listen 443 default;
server_name _;
...
- 266
14
votes
How does the attacker discover our server?
This seems like it is just random scanners on the internet. They just roam around trying different IP adresses and looking for certain folders and files that might indicate vulnerabilities.
- 1,212
12
votes
Why am I getting strange HTTP requests for non-existing pages?
The attacker tries to find out if you have certain premade web software installed by requesting files which are typical for them.
When they find out you use, say, wordpress or phpbb or mediawiki, ...
- 48.8k
11
votes
nginx - How to prevent processing requests with undefined server names with HTTPS
Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to ...
- 5,454
11
votes
Nikto authentication
I actually went ahead and checked out your challenge and noticed that it required the cookie fusion_user for loading up the challenge. This can be confirmed from the BurpSuite Screenshot I have posted ...
- 341
10
votes
Why am I getting strange HTTP requests for non-existing pages?
Yes, those are scans.
If you Google those strings you will see that they show up in the web logs of numerous sites throughout the Internet, usually cheap webhost sites which put their logs up where ...
- 71.8k
8
votes
Accepted
Source code disclosure vulnerability
That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL ...
- 35.5k
7
votes
Accepted
Configuring burp to use in proxy environment
Configure your browser to point to Burp's proxy details (e.g. 127.0.0.1:8080) and then configure Burp to use an upstream HTTP proxy for all target hosts (* as the destination):
However, if the ...
- 132k
6
votes
How to determine if someone is scanning my server?
Is your system publicly accessible?
Yes: Someone is probably scanning it.
No: Are you scanning the server?
Yes: Well, you've just answered your own question now haven't you?
No: It's probably not ...
- 27k
6
votes
Accepted
Cross Domain Javascript security
Yes, all your assumptions are correct there.
As you are including content from addthis.com, your client-side Origin is fully trusting this domain. If there was any compromise to addthis.com, or if ...
- 33.2k
6
votes
Accepted
How to defend against web server security scanners?
The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
- 390
5
votes
nginx - How to prevent processing requests with undefined server names with HTTPS
If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/...
- 181k
5
votes
Accepted
Was my phpMyAdmin hacked?
Those log entries look like normal scanning activity.
You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
- 29k
5
votes
Accepted
Vulnerability scanning vs fuzzing a web application
The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. ...
- 166
4
votes
Accepted
Can anyone recognise this sudden influx of malformed HTTP requests?
These requests are caused by Adware:Win32/Adpeak malfunctioning (yeah, believe it or not, even malware can malfunction).
It sets up a proxy server on the infected systems that injects script tags in ...
- 156
4
votes
Can anyone recognise this sudden influx of malformed HTTP requests?
Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the ...
- 171
4
votes
Credentialed scans and the Burp Suite active Scanner
Burp has some relatively complex options available for session handling but in the basic case, the scanner will use sessions from burps "cookie jar", so as long as it knows about a valid session ID it'...
- 60.7k
4
votes
How to Estimate time taken for Web Application Security Testing?
I'd add my opinion on this. Let's say you have an application to test (I am not including thick clients here as it's pure web application). The conditions on which the estimation might rely are:
...
- 1,602
4
votes
Accepted
Strange requests to my server
This appears to be a bot looking for common vulnerabilities in websites. Such bots are very commonly run by black-hat hackers to identify potential hacking targets. All websites get scanned by such ...
- 48.8k
4
votes
IBM AppScan false positive
There are two possible answers.
Either: because vulnerability scanners are by their nature 'dumb', that is they are operating based on pre-configured logic, they will make a best guess at what could ...
- 2,923
4
votes
Can websites access computers in LAN/Localhost through browser & how to block them?
Most browsers don't distinguish between WAN, LAN and local host. This means they apply the same policies and restrictions for cross-site requests from WAN to LAN as between different sites on the WAN ...
- 181k
3
votes
Accepted
Scan all possible files on server (Brute force Filenames)
Check out DirBuster where you can feed wordlists and it'll try to brute force file and directory names.
Nikto also checks for commonly used folder and file names on a web server.
It is not possible ...
- 33.2k
3
votes
Burp Suite Active Scanning Wizard options
It is best to plan out and control each URI (params or not) sent to the active/passive scanning engine.
The target analyzer in the engagement tools (typically selected from the Target sitemap tab as "...
- 18.9k
3
votes
Accepted
Are web vulnerability scanners active or passive?
Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active.
Damage due to testing for SQL Injection may depend on both App and Scanner. If ...
- 774
3
votes
Are web vulnerability scanners active or passive?
Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page ...
- 8,301
3
votes
How to determine if someone is scanning my server?
Short version : there is no central / unique command to check this by default on linux
.. but you could rely on several tools, depending on the kind of scanning that you would like to find :
...
- 386
Only top scored, non community-wiki answers of a minimum length are eligible