Tag Info

Zed Attack Proxy from OWASP - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project And generally I would advise browsing the site to learn more about security Metasploit community edition is free - http://www.metasploit.com/about/choose-right-edition/

Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not? Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow? Your BA approved this. Did she say why it should be permitted? What happens in your portal when an ...

I'd like to point out in contrast to Phil's answer that the OWASP project is related to Application Security testing. Network security testing is much larger, and often doesn't include application security, but rather considers it a separate but very important part of overall security testing. Network security testing is typically related to network ...

Welkome Ashok. I think that you need to be very careful with this. Security testing is a field that you REALLY, REALLY need to know what you are testing for. Security testing does not simply mean "point a tool at a site and get the results" If you are looking for an "open source tool that will be faster and accurate in finding security holes", and asking ...

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks. Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack. Consider what kinds of escape characters, improper type handling, etc could make their ...

If you are hoping to find the vulnerabilities through an automate scan Open the application, click "Start New Scan", enter the address, and then start scan. Please note, the community edition will really only find low hanging fruit. Anything more difficult requires a subscription. If you're hoping to do some manual testing for injection vulnerabilities, ...

I think much like any new application, once you get it up and running walk through any demos that may be provided. If there are forums you might want to look at those as well. Clearly as their site indicates as you are working with it be sure you are only doing it against a site that you are authorized to perform that sort of penetration testing on.

Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS. Prevention is the best defense. The best first line of defense is to integrate security into your software ...

Not too surprisingly I agree with what the other people have said (I'm the ZAP project lead;). However there are still various options available to you. One option is to disable any of the ZAP scanning rules that do not apply to your site, or that you are not worried about. For example, if your site doesnt use Oracle then theres no point in using the ...

Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com. For example, most vulnerabilities in many common web-applications (eg) WordPress, osCommerce, Joomla (etc) are/were because folders were left right-enabled and/or ...

For the most part mobile web applications behave exactly the same as their counterparts on a desktop. Even if the user input is slightly different, the mobile application is still interfacing with the device running it in a similar fashion, sending along similar protocols and being interpreted on the back end is as well (likely). If information is being ...

I've used a couple of solutions for this in the past. Both Acunetix and IBM Rational AppScan will test for Reflected, Stored, and DOM based Cross Site Scripting. Both applications will provide you all relevant information including request, response, potential impact, etc. AppScan will actually provide a screen shot from what I can remember. Both will ...