Acunetix Blog

http://news.ycombinator.com/item?id=5090007 A few days after reporting the flaw, he got caught using http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions. I still think it sucks that they expelled him. But I am unable to logically see how he didn't break the rules.

The web apps I've seen that do this all look pretty scammy. I wouldn't want them poking around my site. Then again, it is a public site, so... Anyhow, since there are several major attack vectors, there are also several different types of scanners. I recommend you read the book "breaking web software" to get a better understanding of the types of attacks. As far as tools, if you have a PHP install I recommend https://chorizo-scanner.com/ No recommendation, but http://www.acunetix.com/cross-site-scripting/scanner.htm looks like they can help. IBM has a good article/series on web app vulnerabilities at http://www.ibm.com/developerworks/web/library/wa-appsecurity/ And finally, wapiti is a vulnerability checker written in python that will do scans of web apps. COmmand line, not web, but pretty good - http://wapiti.sourceforge.net/

I've read through the spec along with the FAQ that epeus so graciously shared here. The idea of mentioning beyond the scope of one website's walled garden seems like a very natural progression of ActivityPub and the new-found hype surrounding Mastodon. My concern is that I haven't seen much thought into the security implications. The spec makes it clear that they're trying to simplify pingbacks but they don't address the fundamental security problems with pingbacks in the first place. And anyone who's maintained a Wordpress site will tell you, the first thing you do is turn off the Trackback and Pingback features [1] because not only does it attract the scummiest deluge of spam [2] but they've also been useful for disclosing internal network info and [3] leveraged to target other websites in DDoS attacks. [4] The only thought given to preventing abuse is as follows from Section 4.1: >The verification process SHOULD be queued and processed asynchronously to prevent DoS attacks per section 3.2. >Receivers MUST verify Webmentions per section 3.2.2. The first directive isn't a guarantee a DoS attack won't block all IO, it just means don't make it trivial to bring a site down with webmentions. The second directive sounds nice but if you read through section 3.2.2 of the recommendation, it just mandates that you should validate the application data that's submitted. [5] There's no mechanism to authenticate messages, validate the sender, nor limit mentions to a set of trusted…

If you don't do very much stuff, then sure. But most people end up coding long enough that learning new things is well worth the time. It's not like it takes more than a few months to learn a new framework or language, and you get benefits beyond just the new tools. Visual Basic is still a language that many people know better than other languages, but I'd not advise those people to stay on VB just because they know VB. And PHP is getting a fresh coat of paint but that doesn't mean it isn't antiquated - what other web based programming environments provide a CGI model where scripts are in the public directory? How many of them are HTML with directions for the actual programming language? If PHP is intended to stand on its own as a web development language, they've missed a few bits of low hanging fruit already. Like, take HTML out of the language. Package PHP with Composer. Allow for a new app base model where apps have their own FCGI servers and routing is done in PHP. I mean why not? These are things that modern users of PHP already try to accomplish, sometimes with [ugly hacks that are prone to security issues](https://www.acunetix.com/vulnerabilities/web/nginx-php-code-execution-… I don't care if people think I'm just being a hater for the sake of it. I really think PHP is a dead end, and I think that because it seems the focus for PHP development has been toward making older software like MediaWiki run better rather than make PHP a better platform…

Self-maintaining code is a very rare thing. In general, if they were truly seeing no uptake on it, they could just be justified removing it to decrease their security surface (https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-rss-feed… I'd have to know which NGO and what their circumstances are to have a more concrete opinion. With no additional information, I can construct a hypothetical scenario where a reasonable site admin would yank RSS.

This is not the first time that WP Fastest Cache has had a SQL injection vulnerability discovered. Here’s a report on 0.8.4.8: https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-faste… Here’s a report on 0.8.7.4: https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-faste… I could go on (all night) but I trust you all get the point. I have two questions. First, at what point can we say “Emre, you’re really bad at writing code. There are lots of other jobs. Find another.” Second and more importantly for the future of the web, how can we as an industry protect innocent users from projects like this?? This monstrosity has over 1 million active installs and the chuckle head doesn’t have a fucking clue how to write SQL.

Good question. Because it is an old protocol, vulnerabilities have been discovered in it over time [1]. Got to keep things updated! [1] https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-fin…

It’s prudent to have some limit, to protect against long password DoS attacks (https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-s… 63 is such a limit and long enough to allow users to pick secure passwords.

If anyone's curious this references the 8.3 filename shortening that windows was even still doing recently. Amusingly, that tiny bit of backward compatibility can lead to vulnerabilities as outlined here: https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web…

I was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vector. https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-attack/

Host header attacks aren't exactly new [0]. However it seems that this is deliberately vague to prevent people from exploiting it whilst systems are patched. I note that the CVE details [1] are not yet available, so perhaps the actual issue is a bit more complex. [0] https://www.acunetix.com/blog/articles/automated-detection-of-host-hea… [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0787

Reflected XSS is still a big security problem. http://www.acunetix.com/blog/articles/non-persistent-xss/

Vulnerability scanners are usually premium (paid) products. Some offer free trials such as Qualys: https://www.qualys.com/forms/freescan/ Other famous tools are nessus, and accunetix: https://www.tenable.com/products/nessus-vulnerability-scanner, http://www.acunetix.com/vulnerability-scanner/ These scanners are usually used by security consultants to test a complete internal network of a client. For a full list, some of which are open source, check this link: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools

http://www.acunetix.com/blog/web-security-zone/should-you-test-develop… what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security providers having to deal with alerts Final cleanup needed after the fact

> there are two free (oss?) programs I'd recommend: Nessus and Snort Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner! To the OP: If you want to test your website for security flaws, you can do the following (in no particular order): - Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 - Request a free scan from Qualys: http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6390 - Download and run w3af: http://w3af.sourceforge.net/ - Buy Burp v1.2 (when it comes out, soon. it's only about $150) and run Burp Scanner: http://portswigger.net/suite/ - Download Acunetix for a free XSS scanner: http://www.acunetix.com/cross-site-scripting/Copy-scanner.htm - Download SQLiX for a free SQL injection scanner: http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project - ratproxy is a largely passive web application security audit tool: http://code.google.com/p/ratproxy/ and http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ - Test it by hand yourself: OWASP Testing Guide: http://www.owasp.org/index.php/Category:OWASP_Testing_Project OWASP Guide to Building Secure Web Applications: http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP AppSec FAQ: http://www.owasp.org/index.php/OWASP_AppSec_FAQ > Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a…