118 votes
Accepted

How does the attacker discover our server?

The short answer is that many people are scanning everything most of the time. Doing so was, some years back, considered impractical, but the combination of better networks, better tools better ...
user avatar
33 votes
Accepted

Why am I getting strange HTTP requests for non-existing pages?

These types of spurious requests are very, very common. They are either looking to see if you are already compromised, or looking to get your server to throw an error to gather info about your server (...
user avatar
  • 123k
15 votes
Accepted

nginx - How to prevent processing requests with undefined server names with HTTPS

I've solved it by generating a fake certificate that doesn't reveal domain name and adding it as a default one on the start of the config: server { listen 443 default; server_name _; ...
user avatar
  • 266
14 votes

How does the attacker discover our server?

This seems like it is just random scanners on the internet. They just roam around trying different IP adresses and looking for certain folders and files that might indicate vulnerabilities.
user avatar
  • 1,212
12 votes

Why am I getting strange HTTP requests for non-existing pages?

The attacker tries to find out if you have certain premade web software installed by requesting files which are typical for them. When they find out you use, say, wordpress or phpbb or mediawiki, ...
user avatar
  • 48.8k
11 votes

nginx - How to prevent processing requests with undefined server names with HTTPS

Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to ...
user avatar
  • 5,454
11 votes

Nikto authentication

I actually went ahead and checked out your challenge and noticed that it required the cookie fusion_user for loading up the challenge. This can be confirmed from the BurpSuite Screenshot I have posted ...
user avatar
10 votes

Why am I getting strange HTTP requests for non-existing pages?

Yes, those are scans. If you Google those strings you will see that they show up in the web logs of numerous sites throughout the Internet, usually cheap webhost sites which put their logs up where ...
user avatar
  • 71.8k
8 votes
Accepted

Source code disclosure vulnerability

That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL ...
user avatar
  • 35.5k
7 votes
Accepted

Configuring burp to use in proxy environment

Configure your browser to point to Burp's proxy details (e.g. 127.0.0.1:8080) and then configure Burp to use an upstream HTTP proxy for all target hosts (* as the destination): However, if the ...
user avatar
  • 132k
6 votes

How to determine if someone is scanning my server?

Is your system publicly accessible? Yes: Someone is probably scanning it. No: Are you scanning the server? Yes: Well, you've just answered your own question now haven't you? No: It's probably not ...
user avatar
  • 27k
6 votes
Accepted

Cross Domain Javascript security

Yes, all your assumptions are correct there. As you are including content from addthis.com, your client-side Origin is fully trusting this domain. If there was any compromise to addthis.com, or if ...
user avatar
6 votes
Accepted

How to defend against web server security scanners?

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
user avatar
  • 390
5 votes

nginx - How to prevent processing requests with undefined server names with HTTPS

If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/...
user avatar
5 votes
Accepted

Was my phpMyAdmin hacked?

Those log entries look like normal scanning activity. You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
user avatar
  • 29k
5 votes
Accepted

Vulnerability scanning vs fuzzing a web application

The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. ...
user avatar
  • 166
4 votes
Accepted

Can anyone recognise this sudden influx of malformed HTTP requests?

These requests are caused by Adware:Win32/Adpeak malfunctioning (yeah, believe it or not, even malware can malfunction). It sets up a proxy server on the infected systems that injects script tags in ...
user avatar
  • 156
4 votes

Can anyone recognise this sudden influx of malformed HTTP requests?

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the ...
user avatar
4 votes

Credentialed scans and the Burp Suite active Scanner

Burp has some relatively complex options available for session handling but in the basic case, the scanner will use sessions from burps "cookie jar", so as long as it knows about a valid session ID it'...
user avatar
  • 60.7k
4 votes

How to Estimate time taken for Web Application Security Testing?

I'd add my opinion on this. Let's say you have an application to test (I am not including thick clients here as it's pure web application). The conditions on which the estimation might rely are: ...
user avatar
4 votes
Accepted

Strange requests to my server

This appears to be a bot looking for common vulnerabilities in websites. Such bots are very commonly run by black-hat hackers to identify potential hacking targets. All websites get scanned by such ...
user avatar
  • 48.8k
4 votes

IBM AppScan false positive

There are two possible answers. Either: because vulnerability scanners are by their nature 'dumb', that is they are operating based on pre-configured logic, they will make a best guess at what could ...
user avatar
  • 2,923
4 votes

Can websites access computers in LAN/Localhost through browser & how to block them?

Most browsers don't distinguish between WAN, LAN and local host. This means they apply the same policies and restrictions for cross-site requests from WAN to LAN as between different sites on the WAN ...
user avatar
3 votes
Accepted

Scan all possible files on server (Brute force Filenames)

Check out DirBuster where you can feed wordlists and it'll try to brute force file and directory names. Nikto also checks for commonly used folder and file names on a web server. It is not possible ...
user avatar
3 votes

Burp Suite Active Scanning Wizard options

It is best to plan out and control each URI (params or not) sent to the active/passive scanning engine. The target analyzer in the engagement tools (typically selected from the Target sitemap tab as "...
user avatar
  • 18.9k
3 votes
Accepted

Are web vulnerability scanners active or passive?

Most commercial and free web app scanner are active scanners. Both W3AF and Vega generates traffic. So they are active. Damage due to testing for SQL Injection may depend on both App and Scanner. If ...
user avatar
  • 774
3 votes

Are web vulnerability scanners active or passive?

Web app vulnerability scanners typically use a combination of active and passive vulnerability detection, with the majority of the testing done actively. For example, if the scanner requests a page ...
user avatar
  • 8,301
3 votes

How to determine if someone is scanning my server?

Short version : there is no central / unique command to check this by default on linux .. but you could rely on several tools, depending on the kind of scanning that you would like to find : ...
user avatar
  • 386

Only top scored, non community-wiki answers of a minimum length are eligible