Testing a server for security vulnerabilities

Question

I'm looking for a good tool (software or web service) which can check a Windows web server for possible vulnerability issues. The more the better. (Checking from outside, by a given IP address, but possibly also from inside.)

I see there are a lot of web services out there, but:

1. I'm not sure whether I can trust them
2. I'm not sure if they are really good and reliable

Answer 1

The de-facto tool for this is Metaploit. It currently has support for 1200 exploits of which ~900 apply to Windows.

You'd typically run Metasploit from a Kali Linux via the Metasploit console msfconsole. From there you use an exploit, set a target, set payload and exploit it.

Must have resource: the SANS Metasploit cheat sheet

Metasploit (the command line version, I have no experience with the paid versions) is not self-explaining, so you might take an online course, e.g. Penetration Testing and Ethical Hacking with Kali Linux at Pluralsight (there's a free trial that should be sufficient to watch this one).

---

Note that the default download page [1] just distinguishes between the community edition and the Pro version but if you look at the editions page [2] there is also the "framework" edition, which is the command line tool used by security analysts and released as open source (BSD license).

If you extract the .tar.bz2 archive, make sure your virus scanner is turned off or excludes the directory you're extracting to, otherwise the virus scanner will quarantine many of the files, since they are known to be threats.

Answer 2

Vulnerability scanners

Web penetration testing tools (scanners/crawls):

• WebCruiser Web Vulnerability Scanner - an effective web penetration testing tool that will aid you in auditing your website.
• Wapiti - the web-application vulnerability scanner.
• Nikto - web server scanner to look for potentially dangerous files/programs.
• SecApps/WebSecurify - Online Vulnerability Scanner & Security Tools.
• Skipfish (GH mirror) - web application security reconnaissance tool.
• inspathx (GH mirror) - Tool For Finding Path Disclosure Vulnerabilities.
• WIVET - a benchmarking project that aims to statistically analyze web link extractors.
• Arachni - Web Application Security Scanner Framework.
• Nagios with some security plugins.
• and so on.

No longer being maintained:

• WebScarab - a proxy to sniff the HTTP(S) traffic with feature for testing XSS and SQL injection vulnerabilities), or "CRLF injection (HTTP response splitting)" and more.

Commercial:

• Netsparker - (free) web application security scanner
• Burp Suite (PortSwigger) - security testing of web applications.
• Acunetix Web Vulnerability Scanner (paid) - scans for SQL Injection, XSS, XXE, SSRF, Host Header Attacks & over 3000 other web vulnerabilities.
• AppSpider (NTOSpider) - web application security scanner.
• HP WebInspect - an automated dynamic application security testing (DAST) tool that mimics real-world hacking techniques and attacks.
• IBM Security AppScan - static and dynamic application security testing.
• Trustwave (Hailstorm) - Cenzic's dynamic application security testing (DAST).
• Qualys - Security & Compliance Suite

Other:

• OWASP - a community which issues software tools and knowledge-based documentation on application security. See wiki page.
• WhatWeb - next generation web scanner to identify technologies that power a website, SQL errors, and more.

Proxies

• The OWASP Zed Attack Proxy (ZAP) - helps you automatically find security vulnerabilities in your web applications (see wiki page).
• ratproxy - a semi-automated, largely passive web application security audit tool.
• Paros - proxy for assessing web application vulnerability.
• Fiddler with x5s extension to assist penetration testers in finding XSS vulnerabilities or Watcher (passive web-security scanner).

SQL Injection

See: OpenSource Security scan tools for REST APIs

PHP

For PHP malware scanners, see: Malware scanner for websites code?