Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

420 questions
123
votes
8 answers

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:427 and some others. The OS fingerprint says…
hsnm
  • 1,301
  • 1
  • 10
  • 12
49
votes
5 answers

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom,…
atdre
  • 19,162
  • 6
  • 63
  • 112
33
votes
8 answers

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php . I understand that this is very common and it's not really an issue for me, as I have secured the server in a…
SaAtomic
  • 1,029
  • 3
  • 18
  • 30
30
votes
5 answers

Web server attack methodology: why bother with manual tests if vulnerability scanner does it all?

I'm reading a white hat hacking book from a famous certification. They say the methodology for hacking a web server is: information gathering (domain name, DNS, IP, etc.) footprinting (ex: banner grabbing) website mirroring vulnerability scanning…
botanga
  • 447
  • 5
  • 5
27
votes
1 answer

What questions should be asked when joining a new security team?

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment and start gathering ideas about things to…
bobmagoo
  • 434
  • 4
  • 11
27
votes
4 answers

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but let's assume (for convenience) we're talking…
blong
  • 379
  • 1
  • 3
  • 9
26
votes
3 answers

Should I report a security vulnerability?

I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?
Polaris Alderson
  • 301
  • 3
  • 3
25
votes
3 answers

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned occasionally to identify potential vulnerabilities that must…
Dantre
  • 353
  • 3
  • 5
25
votes
4 answers

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

Say, I have scanned our Cisco Router, and it returned 20 vulnerabilities back. However, most of them are tied to specific services that this router is not running, for example CVE-2016-6380 - we are not running dns server on our cisco thus we are…
shivelin
  • 458
  • 4
  • 7
22
votes
6 answers

Browsing exploits with Metasploit console

Is there any way to browse certain exploits in MSFconsole? The show exploits command shows too many and I cannot find a way to show just Windows file format exploits, for example.
Sonny Ordell
  • 3,646
  • 10
  • 41
  • 60
21
votes
4 answers

How can you check and analyze SSL ports other than 443?

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
Chloe
  • 1,828
  • 4
  • 17
  • 32
20
votes
3 answers

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about implementing a library he has never heard about and ask…
Eduardo Cereto
  • 335
  • 1
  • 2
  • 7
19
votes
2 answers

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the box, there is no result at all for some of the IPs.…
J. Caballero
  • 193
  • 1
  • 1
  • 4
19
votes
4 answers

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal .
AviD
  • 73,915
  • 26
  • 144
  • 224
16
votes
2 answers

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
AviD
  • 73,915
  • 26
  • 144
  • 224
1
2 3
…
27 28