Nexus: Acunetix

Acunetix Online Vulnerability Scanner

Read

Acunetix Online Vulnerability Scanner acts as a virtual security officer for your company, scanning your websites, including integrated web applications, web servers and any additional perimeter servers for vulnerabilities. And allowing you to fix them before hackers exploit the weak points in your IT infrastructure!

Leverages Acunetix leading web application scanner

Building on Acunetix’ advanced web scanning technology, Acunetix OVS scans your website for vulnerabilities – without requiring to you to license, install and operate Acunetix Web Vulnerability scanner. Acunetix OVS will deep scan your website – with its legendary crawling capability – including full HTML 5 support, and its unmatched SQL injection and Cross Site Scripting finding capabilities.

Unlike other online security scanners, Acunetix is able to find a much greater number of vulnerabilities because of its intelligent analysis engine – it can even detect DOM Cross-Site Scripting and Blind SQL Injection vulnerabilities. And with a minimum of false positives. Remember that in the world of web scanning its not the number of different vulnerabilities that it can find, its the depth with which it can check for vulnerabilities. Each scanner can find one or more SQL injection vulnerabilities, but few can find ALMOST ALL. Few scanners are able to find all pages and analyze all content, leaving large parts of your website unchecked. Acunetix will crawl the largest number of pages and analyze all content.

Utilizes OpenVAS for cutting edge network security scanning

And Acunetix OVS does not stop at web vulnerabilities. Recognizing the need to scan at network level and wanting to offer best of breed technology only, Acunetix has partnered with OpenVAS – the leading network security scanner. OpenVAS has been in development for more then 10 years and is backed by renowned security developers Greenbone. OpenVAS draws on a vulnerability database of thousands of network level vulnerabilities. Importantly, OpenVAS vulnerability databases are always up to date, boasting an average response rate of less than 24 hours for updating and deploying vulnerability signatures to scanners.

Start your scan today

Getting Acunetix on your side is easy – sign up in minutes, install the site verification code and your scan will commence. Scanning can take several hours, depending on the amount of pages and the complexity of the content. After completion, scan reports are emailed to you – and Acunetix Security Consultants are on standby to explain the results and help you action remediation. For a limited time period, 2 full Network Scans are included for FREE in the 14-day trial.

Acunetix Online Vulnerability Scanner

Read More Add comment

WVS v9.5 - Acunetix Web Vulnerability Scanner

By 0x000216

Read

0 Comments

Read More Add comment

Acunetix Web Vulnerability Scanner Version 9 - Web Application Security Testing Tool

By 0x000216

Read

0 Comments

Acunetix Web Vulnerability Scanner (WVS) is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive web site and web application penetration testing.

Changelog v9.20140206

New Functionality in Acunetix Web Vulnerability Scanner v9

Added a test for Joomla! JomSocial component < 3.1.0.1 – Remote code execution
Added a test for a MediaWiki Remote Code Execution vulnerability affecting versions older than 1.22.2,1.21.5 and 1.19.11
Added a test for Minify arbitrary file disclosure
Added a test for Ektron CMS admin account takeover
Added a test for Zabbix SQL injection vulnerability
Added a test for IBM Web Content Manager XPath Injection
Added a test for YUI library uploader.swf cross site scripting vulnerability. This library is included in many web applications, including vBulletin v4 and v5
Added a test for Horde Remote Code Execution
Added a test for Joomla! JCE Arbitrary File Upload
Added a test for Oracle Reports vulnerabilities. These vulnerabilities allow an attacker to gain remote shell on the affected server
Added a test for XXE vulnerabilities in OpenID implementations, which is able to detect XXE vulnerabilities similar to the one found on Facebook recently
A knowledge base item is added each time a known web application is detected (e.g. WordPress web application was detected in directory /blog/)

Improvements

Scanning of WordPress sites has been made more efficient
Improved coverage of ASP.NET based websites
Improved XSS testing script

Bug Fixes

Fixed bug in the pagination of the Scheduler Web Interface
The Login Sequence Recorder was ignoring the maximum size HTTP option
Fixed an issue causing the crawler to create multiple entries of the same custom cookie.
Fixed a bug causing the HTTP sniffer to always listen on localhost
Fixed a bug in the console application preventing scanning from older saved crawl results.
Fixed a crash caused at start-up caused by the DeepScan agent not starting.

Download Acunetix Scanner 9

Read More Add comment

[Acunetix Web Vulnerability Scanner 8] Automated Web Application Security Testing Tool

By 0x000216

Read

0 Comments

Changelog v8.20130308

Unicode Transformation Issues

This new security test is looking for issues that can occur when working with Unicode data. Specifically, it is looking for Best-Fit mappings, Overlong byte sequences and Ill-Formed Subsequences issues.

Best-Fit Mappings occurs when a character X gets transformed to an entirely different character Y. For example, in some situations the Unicode character U+FF1C FULLWIDTH LESS-THAN SIGN can be transformed into U+003C LESS-THAN SIGN (<). This can cause serious security problems for the affected web application.

Overlong byte sequences (non-shortest form) – UTF-8 allows for different representations of characters that also have a shorter form. For security reasons, a UTF-8 decoder must not accept UTF-8 sequences that are longer than necessary to encode a character. For example, the character U+000A (line feed) must be accepted from a UTF-8 stream only in the form 0x0A, but not in any of the following five possible overlong forms:

0xC0 0x8A
0xE0 0×80 0x8A
0xF0 0×80 0×80 0x8A
0xF8 0×80 0×80 0×80 0x8A
0xFC 0×80 0×80 0×80 0×80 0x8A

Ill-Formed Subsequences - As REQUIRED by UNICODE 3.0, and noted in the Unicode Technical Report #36, the web application should not consume a leading byte when it is followed by an invalid successor byte. For example, at some point PHP was consuming the control characters leading to XSS and SQL injection vulnerabilities.

Analyze Parameter Values

Another script introduced with this update is Analyze_Parameter_Values.script. This script is analyzing parameter values and performs various actions based on their values. For example, if the parameter value contains a filename or a file path, the script will pass this information to the crawler and these files will be crawled and tested in the next scan iteration.

Hidden Virtual Hosts

Finally, the latest update contains a script that is trying to find hidden Virtual Hosts on the tested web server. Virtual hosting is a method for hosting multiple domain names on a single web server.

Sometimes developers hosts internal/test applications on production systems without making them public. These virtual hosts are not directly accessible unless you guess the name of their virtual host, connect to the web server’s IP address and specify the virtual host in the Host header.

This script is looking for common Virtual Host names and compares the responses received with the normal response. When it finds differences, it will issue alerts for these names.