2

I'm looking for a good tool (software or web service) which can check a Windows web server for possible vulnerability issues. The more the better. (Checking from outside, by a given IP address, but possibly also from inside.)

I see there are a lot of web services out there, but:

  1. I'm not sure whether I can trust them
  2. I'm not sure if they are really good and reliable
Improve this question
5
  • 2
    This is way too broad. It's impossible to scan for all possible vulnerabilities. Some vulns haven't even been found yet. – Mark Buffalo Nov 23 '15 at 21:04
  • I agree that it's broad, but I don't think it's so broad that it needs to be closed. I think the OP probably realizes that vulnerability detection tools are not perfect. – RockPaperLz- Mask it or Casket♦ Nov 23 '15 at 21:40
  • @MarkHulkalo: "the more the better" slightly indicates that OP is aware that some (unknown and even known) vulnerabilities may not be detected. – Thomas Weller Nov 23 '15 at 22:04
  • Are you looking for something like Metasploit? – Huey Nov 24 '15 at 0:38
  • @MarkHulkalo I didn't mean to check for "unknown vulns". Mainly, what I am looking for is to have a kind of "sanity check" for a server which looks for common known issues. For example, it could discover if some default Wordpress account has a "common password" or something similar. I just want to be sure that I have not overseen some detail and that I don't have a backdoor open without knowing it. I'm quite a good C#/SQL developer and so I know about SQL injection and such, but I lack the broad knowledge of a server admin. I am simply not sure if my system is really save. – user14394 Nov 24 '15 at 7:08
0

The de-facto tool for this is Metaploit. It currently has support for 1200 exploits of which ~900 apply to Windows.

You'd typically run Metasploit from a Kali Linux via the Metasploit console msfconsole. From there you use an exploit, set a target, set payload and exploit it.

Must have resource: the SANS Metasploit cheat sheet

Metasploit (the command line version, I have no experience with the paid versions) is not self-explaining, so you might take an online course, e.g. Penetration Testing and Ethical Hacking with Kali Linux at Pluralsight (there's a free trial that should be sufficient to watch this one).

Note that the default download page [1] just distinguishes between the community edition and the Pro version but if you look at the editions page [2] there is also the "framework" edition, which is the command line tool used by security analysts and released as open source (BSD license).

If you extract the .tar.bz2 archive, make sure your virus scanner is turned off or excludes the directory you're extracting to, otherwise the virus scanner will quarantine many of the files, since they are known to be threats.

Improve this answer
5
  • Metasploit is an ok tool for demonstrating to skeptical bosses how simple it is to get access to their systems. It is most definitely not a tool I'd use to identify new vulnerabilities because it only knows what's been written for it. Now, modules get updated pretty quickly, so it does have value - but never rely on it. – Rory Alsop Nov 23 '15 at 21:39
  • @RoryAlsop: As I read the question, OP is not looking to identify new vulnerabilities but test a server against known vulnerabilities. – Thomas Weller Nov 23 '15 at 21:50
  • Hmmm - not how I read it at all. He used the wording I usually get from folks who don't understand how security testing works. – Rory Alsop Nov 23 '15 at 21:51
  • @RoryAlsop: exactly. So you don't expect someone like that to discover new vulnerabilities, right? – Thomas Weller Nov 23 '15 at 22:02
  • Thank you! Metasploits looks very good! @RoryAlsop - well, I'm mainly a developer, so I know about open ports, about SQL Injection, good passwords. But I lack the knowledge of a good server admin. I'm running a Windows Server 2008, with RDP and Wordpress, and I just would be sure that it is "safe". Lately, I've seen are lots of tries to break in via ftp (I closed it now), so I'm a little bit concerned. Possibly it would be best to hire some expert I can trust. – user14394 Nov 24 '15 at 7:00
1

Vulnerability scanners

Web penetration testing tools (scanners/crawls):

No longer being maintained:

  • WebScarab - a proxy to sniff the HTTP(S) traffic with feature for testing XSS and SQL injection vulnerabilities), or "CRLF injection (HTTP response splitting)" and more.

Commercial:

  • Netsparker - (free) web application security scanner
  • Burp Suite (PortSwigger) - security testing of web applications.
  • Acunetix Web Vulnerability Scanner (paid) - scans for SQL Injection, XSS, XXE, SSRF, Host Header Attacks & over 3000 other web vulnerabilities.
  • AppSpider (NTOSpider) - web application security scanner.
  • HP WebInspect - an automated dynamic application security testing (DAST) tool that mimics real-world hacking techniques and attacks.
  • IBM Security AppScan - static and dynamic application security testing.
  • Trustwave (Hailstorm) - Cenzic's dynamic application security testing (DAST).
  • Qualys - Security & Compliance Suite

Other:

  • OWASP - a community which issues software tools and knowledge-based documentation on application security. See wiki page.
  • WhatWeb - next generation web scanner to identify technologies that power a website, SQL errors, and more.

Proxies

  • The OWASP Zed Attack Proxy (ZAP) - helps you automatically find security vulnerabilities in your web applications (see wiki page).
  • ratproxy - a semi-automated, largely passive web application security audit tool.
  • Paros - proxy for assessing web application vulnerability.
  • Fiddler with x5s extension to assist penetration testers in finding XSS vulnerabilities or Watcher (passive web-security scanner).

SQL Injection

See: OpenSource Security scan tools for REST APIs

PHP

For PHP malware scanners, see: Malware scanner for websites code?

Improve this answer
1
  • 1
    Thanks, great list! – user14394 Aug 2 '16 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy