IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

395 questions
4
votes
1 answer

Potential False Positive while scanning a network with Nexpose - X509 Certificate mismatch

Little bit of context, we are seeing this finding a lot. We use wildcard certificates on public facing websites. The finding is titled: "X.509 Certificate Subject CN Does Not Match the Entity Name" Below, I have added further details about the…
user146316
  • 43
  • 1
  • 1
  • 3
4
votes
1 answer

Best practices manual for Alienvault USM?

Is there any best practices manual for Alienvault USM? I found some information about the profiles for the vulnerability scanner but nothing about how often I should launch the scan or which categories for a custom profile are dangerous: Deep -…
Blai
  • 43
  • 3
4
votes
1 answer

ASV scan with reverse proxy

We are PCI compliant as a service provider, however our service port forwards some web traffic at TCP level. Customers use our PCI compliant service and can choose to upload a TLS/SSL certificate to us if they want their HTTPS traffic analysed. So…
SilverlightFox
  • 33,408
  • 6
  • 67
  • 178
4
votes
2 answers

IBM AppScan false positive

I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue. How is AppScan able to find vulnerabilities while I cannot find them when manually passing the same…
Newbie1
  • 61
  • 6
3
votes
1 answer

I have patched openssl but SSLTest and Nessus say I am still vulnerable to CVE-2014-0224

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability. $ sudo rpm -q --changelog openssl | grep CVE-2014-0224 - fix…
user3546411
  • 131
  • 1
3
votes
2 answers

PCI Scanning and authenticated user pages

I've just used a security vendor's automated PCI scanning tool to scan my web server. It only has the ability, out of the box, to scan URLs as an un-authenticated user. This means it is only scanning my login page and any other URLs it can…
Yoshi
  • 133
  • 3
3
votes
2 answers

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
Anandu M Das
  • 1,981
  • 14
  • 31
  • 46
3
votes
3 answers

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as reflected xss, persistent xss, sqli, lfi/rfi, and…
user3035360
  • 31
  • 2
3
votes
3 answers

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command like 'search cve-xxxx-xxxx'. Do you have any…
metavaronos
  • 145
  • 2
  • 9
3
votes
2 answers

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The proposal modifies the TCP three-way handshake by only…
Jon
  • 513
  • 1
  • 4
  • 11
3
votes
3 answers

How to decode this exploit scanner?

My server is obviously up to date and not vulnerable to shellshock exploits. However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have a long series of these in my logs, testing various…
augustin
  • 185
  • 2
  • 8
3
votes
2 answers

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET request displays the form with its unique URI…
Thomasleveil
  • 131
  • 3
3
votes
1 answer

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. Do I need to care about all these ETag…
Novice User
  • 2,088
  • 7
  • 26
  • 38
3
votes
2 answers

MS12-020: Remote Code Execution

I'm doing some exercises in the lab. My vuln. scanner detects MS12-020 on a few machines. The report indicates that this could be exploited to allow the execution of code remotely. To me this would mean that there must be some way to upload a…
Juicy
  • 1,407
  • 4
  • 16
  • 31
3
votes
1 answer

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport security updates? I want to prevent false positive…
Michael
  • 1,457
  • 1
  • 18
  • 36
1 2 3
…
26 27