The blog of Acunetix, a web vulnerability scanner vendor, covering TLS attacks, XSS, denial of service, and data breaches.
HN links it for security explainers and vulnerability pages, and commenters mention the scanner in a story about someone caught using it on a network.
I've read through the spec along with the FAQ that epeus so graciously shared here. The idea of mentioning beyond the scope of one website's walled garden seems like a very natural progression of ActivityPub and the new-found hype surrounding Mastodon. My concern is that I haven't seen much thought into the security implications.
The spec makes it clear that they're trying to simplify pingbacks but they don't address the fundamental security problems with pingbacks in the first place. And anyone who's maintained a Wordpress site will tell you, the first thing you do is turn off the Trackback and Pingback features [1] because not only does it attract the scummiest deluge of spam [2] but they've also been useful for disclosing internal network info and [3] leveraged to target other websites in DDoS attacks. [4]
The only thought given to preventing abuse is as follows from Section 4.1:
>The verification process SHOULD be queued and processed asynchronously to prevent DoS attacks per section 3.2.
>Receivers MUST verify Webmentions per section 3.2.2.
The first directive isn't a guarantee a DoS attack won't block all IO, it just means don't make it trivial to bring a site down with webmentions. The second directive sounds nice but if you read through section 3.2.2 of the recommendation, it just mandates that you should validate the application data that's submitted. [5] There's no mechanism to authenticate messages, validate the sender, nor limit mentions to a set of trusted…
> there are two free (oss?) programs I'd recommend: Nessus and Snort
Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner!
To the OP: If you want to test your website for security flaws, you can do the following (in no particular order):
- Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007
- Request a free scan from Qualys: http://www.qualys.com/forms/trials/qualysguard_trial/?lsid=6390
- Download and run w3af: http://w3af.sourceforge.net/
- Buy Burp v1.2 (when it comes out, soon. it's only about $150) and run Burp Scanner: http://portswigger.net/suite/
- Download Acunetix for a free XSS scanner: http://www.acunetix.com/cross-site-scripting/Copy-scanner.htm
- Download SQLiX for a free SQL injection scanner: http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project
- ratproxy is a largely passive web application security audit tool: http://code.google.com/p/ratproxy/ and http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/
- Test it by hand yourself:
OWASP Testing Guide: http://www.owasp.org/index.php/Category:OWASP_Testing_Project
OWASP Guide to Building Secure Web Applications: http://www.owasp.org/index.php/Category:OWASP_Guide_Project
OWASP AppSec FAQ: http://www.owasp.org/index.php/OWASP_AppSec_FAQ
> Hiring a security expert is generally like most other things you hire an expert for - expensive. There's a lot to making a…
If you don't do very much stuff, then sure. But most people end up coding long enough that learning new things is well worth the time. It's not like it takes more than a few months to learn a new framework or language, and you get benefits beyond just the new tools.
Visual Basic is still a language that many people know better than other languages, but I'd not advise those people to stay on VB just because they know VB. And PHP is getting a fresh coat of paint but that doesn't mean it isn't antiquated - what other web based programming environments provide a CGI model where scripts are in the public directory? How many of them are HTML with directions for the actual programming language?
If PHP is intended to stand on its own as a web development language, they've missed a few bits of low hanging fruit already. Like, take HTML out of the language. Package PHP with Composer. Allow for a new app base model where apps have their own FCGI servers and routing is done in PHP. I mean why not? These are things that modern users of PHP already try to accomplish, sometimes with [ugly hacks that are prone to security issues](https://www.acunetix.com/vulnerabilities/web/nginx-php-code-execution-via-fastcgi).
I don't care if people think I'm just being a hater for the sake of it. I really think PHP is a dead end, and I think that because it seems the focus for PHP development has been toward making older software like MediaWiki run better rather than make PHP a better platform…
The web apps I've seen that do this all look pretty scammy. I wouldn't want them poking around my site. Then again, it is a public site, so...
Anyhow, since there are several major attack vectors, there are also several different types of scanners. I recommend you read the book "breaking web software" to get a better understanding of the types of attacks.
As far as tools, if you have a PHP install I recommend https://chorizo-scanner.com/
No recommendation, but http://www.acunetix.com/cross-site-scripting/scanner.htm looks like they can help.
IBM has a good article/series on web app vulnerabilities at http://www.ibm.com/developerworks/web/library/wa-appsecurity/
And finally, wapiti is a vulnerability checker written in python that will do scans of web apps. COmmand line, not web, but pretty good - http://wapiti.sourceforge.net/
This is not the first time that WP Fastest Cache has had a SQL injection vulnerability discovered.
Here’s a report on 0.8.4.8:
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-fastest-cache-sql-injection-0-8-4-8/
Here’s a report on 0.8.7.4:
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-fastest-cache-sql-injection-0-8-7-4/
I could go on (all night) but I trust you all get the point. I have two questions.
First, at what point can we say “Emre, you’re really bad at writing code. There are lots of other jobs. Find another.”
Second and more importantly for the future of the web, how can we as an industry protect innocent users from projects like this?? This monstrosity has over 1 million active installs and the chuckle head doesn’t have a fucking clue how to write SQL.
Vulnerability scanners are usually premium (paid) products. Some offer free trials such as Qualys: https://www.qualys.com/forms/freescan/
Other famous tools are nessus, and accunetix: https://www.tenable.com/products/nessus-vulnerability-scanner, http://www.acunetix.com/vulnerability-scanner/
These scanners are usually used by security consultants to test a complete internal network of a client.
For a full list, some of which are open source, check this link: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools