Questions tagged [vulnerability-scanners]
A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.
419 questions
1 vote
1 answer
91 views
How to build a SAST Review Methodology for .NET
Although there are a number of tools (Burp, metasploit) across multiple training platforms (TryHackMe) with multiple methodologies (Hacktricks, OWASP) for DAST hands-on testing, I've been struggling ...
- 980
15 votes
2 answers
5k views
Web application contains a link to a non-existing domain, is this a vulnerability?
I got a Dynamic Application Security Testing (DAST) scan that reports an issue on a web application. It says "The web application contains a link to a non-existing domain" and it's marked ...
- 559
1 vote
0 answers
139 views
Web Server Generic Cookie Injection
After running a Nessus scan, one of its plugins checks for cookie injection called "Web Server Generic Cookie Injection" (https://www.tenable.com/plugins/nessus/44135) The scan shows that ...
- 559
1 vote
1 answer
214 views
Running zap scan on a web application is not detecting all endpoints
I want to run ZAP automated scan to a web application. I have the url which is example.com/myapp. When I browse the application in burpsuite, I can see some rest endpoints being called like example....
- 559
2 votes
1 answer
126 views
"Scanning" available USB drivers on a port
For network-based attacks, there are many tools that scan a system for open ports and perform fingerprinting to find out what software is running on the system. Does something similar exist for USB ...
- 153
3 votes
1 answer
216 views
can vulnerabilities in transitive dependencies be exploitable?
I am running nmap on an http server, and I got the netty version used by the server. Netty version used is 9.4.53.v20231009 , I tried to check online for CVEs related to this version, and it seems ...
- 559
1 vote
1 answer
169 views
Is there evidence that using SAST / SCA brings positive ROI to software companies?
Using SAST / SCA tools within the delivery pipelines is quite common these days; however, in the software my teams are building, the SAST tools that we're using are very rarely finding even relatively ...
2 votes
2 answers
673 views
Should an HTTP error 500 triggered by an XSS payload be reported as a potential vulnerability?
So, long story short, I was using an automated vulnerability scanner on a website (bounty hunting is allowed and encouraged,) and it works by injecting payloads in forms and URLs etc., to trigger ...
- 4,805
1 vote
0 answers
74 views
How to manage a lot of vulnerability scanners from CICD Pipelines?
My company has a lot of projects and uses various vulnerability scanners (e.g. Trivy, npm audit, SAST,...) in different stages in each of them. The Problem is now that although they run well, it's not ...
- 111
0 votes
0 answers
140 views
Locating Spambot
My mail server (IP, not domains) was recently flagged as a spam source by Spamhaus and I'm looking for help at tracking down the source. First, I verified the forward and reverse DNS records, SPF ...
- 389
1 vote
0 answers
180 views
out-of-band data exfiltration Command Injection [closed]
A few days ago I found a vulnerability in a site of scope using the Burp suite scanner with the command nslookup xxx.burpcolaborator.com exploit with the following feature: Issue: OS command injection ...
- 11
1 vote
0 answers
150 views
Blind SQL Injection on a HP printer?
The vulnerability test from Nexpose scanned the HP printers and last scan shows "Blind SQL Injection / Remedation plan: Ensure that the Web application validates and encodes user input before ...
- 11
2 votes
2 answers
412 views
Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it
I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build. Debian's security tracker states it's fixed: https://security-tracker.debian....
25 votes
3 answers
8k views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 353
0 votes
0 answers
115 views
Network vulnerability scanner optimal positioning in network
Scenario: There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
