Scanning for Heartbleed using Acunetix

Soon after the Heartbleed bug was made public, Acunetix released an update to detect the vulnerability in websites and web applications. The script that detects this is called Heartbleed_Bug.script, and is included in the following Scanning Profiles: Default High_Risk_Alerts The newly created heartbleed profile The Heartbleed bug is considered to be one of the most […]

Read More →

The Aftermath of the Heartbleed Bug

The Heartbleed bug, a security flaw in the popular OpenSSL library used for data encryption, has taken the web security world by storm, and the victim toll has started to rise. The first reported victims include the Canada Revenue Agency (with 900 social security numbers stolen) and Mumsnet, a popular UK website with over 1.5 […]

Read More →

Elaborate Ways to Exploit XSS: XSS Proxies

In his book “Web Application Vulnerabilities: Detect, Exploit, Prevent”, Steve Palmer describes XSS Proxies as cross-site scripting exploitation tools that allow attackers to temporarily take control over the victim’s browser. XSS Proxy functions as a web server which takes commands from the attacker via a web browser, delivering malicious JavaScript payloads to and retrieving information […]

Read More →

CSRF and XSS – Brothers in Arms

What is CSRF (XSRF)? Cross-Site Request Forgery is a type of web attack which exploits the trust of a website in the user’s browser. In essence, the attacker manipulates the victim’s browser to send requests in the user’s name to websites that have been visited or are currently open, without the victim knowing what is […]

Read More →

Latest Acunetix release scans for Heartbleed Bug

Yesterday, an update was released for Acunetix Vulnerability Scanner which includes a test for a critical OpenSSL vulnerability named The Heartbleed Bug (CVE-2014-0160). Quote from the report: The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used […]

Read More →

Elaborate Ways to Exploit XSS: Flash Parameter Injection

Common Cross-site scripting (XSS) attacks rely on the injection of malicious code (usually JavaScript) in HTML pages, HTML headers or page DOM. There are, however, ways of injecting malicious code in less likely, very popular and innocent-looking places, such as Flash objects. The use of Flash objects has dramatically increased over the last years, with […]

Read More →

Persistent Cross-Site Scripting

Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS.  In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application. XSS vulnerabilities are the most common type of input validation […]

Read More →

Visit the Acunetix Stand at Infosecurity Europe 2014

Acunetix is to be exhibited in the New Exhibitor’s Zone at Infosecurity Europe at Earls Court from the 29th of April till the 1st of May. Infosecurity Europe is the largest free-to attend information security business and education event in Europe – offering attendees the opportunity to network with thousands of like-minded information security professionals […]

Read More →