IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [vulnerability-scanners]

A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

395 questions
3
votes
2 answers

Can a Vulnerability Management tool highlight BIOS and driver-level vulnerabilities?

Several known vulnerabilities affect BIOS (Reference URLs below). So my question is, are the Vulnerability Management tools (such as Nessus, NeXpose, Qualys, etc) technically capable of highlighting BIOS and driver-level vulnerabilities? Is this…
lisa17
  • 1,958
  • 7
  • 21
  • 43
3
votes
5 answers

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our app is secure. One thing I'm considering is…
Snitse
  • 271
  • 1
  • 7
3
votes
4 answers

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a payload ? Is it possible for a device to get…
Legolas
  • 563
  • 6
  • 16
3
votes
1 answer

What are good tools for CRLF discovery?

What are good tools for finding CRLF injection vulnerabilities?
Daniel
  • 1,422
  • 3
  • 21
  • 32
3
votes
2 answers

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as we embarked on exercise, we realized that certain…
raghu
  • 283
  • 1
  • 2
  • 7
3
votes
5 answers

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from tools that do not implement this option without…
kinunt
  • 2,759
  • 2
  • 23
  • 30
3
votes
5 answers

Can I scan with nmap from cloud services?

Can i conduct nmap scanning from cloud services (i.e AWS)? i am looking to do external scanning for my company and want to set up something that will be quick, efficient, and cheap. I dont want to stand up my own external box on my own.the cloud…
n_hov
  • 129
  • 1
  • 3
  • 9
3
votes
2 answers

Public registry (database or API) for known security vulnerabilities in open source software?

Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software? Why would anyone want this? I'm trying to emulate github's dependabot on a local server. It simply scans all…
stevec
  • 1,214
  • 1
  • 7
  • 16
3
votes
3 answers

Online security check via command line

My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential flaw I would not be aware of. Most of the time…
Alois Mahdal
  • 391
  • 1
  • 5
  • 16
3
votes
3 answers

Applicability of CVE-2018-14721

My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/detail/CVE-2018-14721 is that the vulnerability is…
Ajmal Ahammed
  • 31
  • 2
3
votes
3 answers

Sample vulnerable web apps to test Pentesting platforms

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application side) to test various solutions on. Does anyone…
user974896
  • 317
  • 4
  • 9
3
votes
3 answers

Best Practice for Suppressing Fortify SCA Findings

I have been searching for an answer as to how you should treat false positives in Fortify scans. For a long time, if something was determined to be a false positive, I would document the reasoning behind why that issue was a false positive and…
developer_117
  • 141
  • 1
  • 5
3
votes
2 answers

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service uses an SSL certificate which supports the use of…
Franko
  • 1,530
  • 5
  • 18
  • 30
3
votes
3 answers

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes are scanned and a composite report for each of…
zharvey
  • 911
  • 3
  • 10
  • 14
3
votes
2 answers

Is SNMPing available anymore?

I am researching SNMP and I read about a scanning tool from SANS called SNMPing. Is this tool still available? I cannot find anywhere to download it. Sending an empty email to snmptool@sans.org just gets rejected.
sourcenouveau
  • 133
  • 1
  • 6
1 2 3
…
26 27