Disneyland Village, Paris, played host to the 2014 IT Partners Trade show which was abuzz with over 12,400 IT professionals in attendance. The trade show was held on the 4th and 5th February 2014, and it proved to be an eventful couple of days with…
How Acunetix Compares to Other Web Application Scanners
Acunetix is once again confirmed as one of the leaders in web application scanning with a 100% detection accuracy and 0% false positives for Reflected Cross-Site Scripting and SQL Injection vulnerabilities, together with a leading WIVET assessment score. In the 2013/2014 Web Application Vulnerability Scanners…
Finding the Source of a DOM-based XSS Vulnerability with Acunetix
DOM-based XSS involves the execution of a payload as a result of modifying the DOM inside the browser used by a client side script. Since the payload resides in the DOM, the payload may not necessarily be sent to the web server. This post covers…
Insider Threats: Dealing with the Enemy Inside
For companies, threats come from two sources—outside the organization and inside (reads: disgruntled, unethical employees). Insider threats can be very difficult to handle and the number of annual incidents is on the rise. The insider threat can come in several forms: Employees who steal intellectual…
BREACH attacks: Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext
BREACH attacks, abbreviated from Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext, are attacks similar to the CRIME attack. Both attacks are compression side channel attacks, however CRIME targets information compressed in HTTP requests through TLS compression, whilst BREACH targets information compressed in HTTP…
The importance of Internal Web Security Assessments
What do things look like on the outside? That’s the main focus we have as human beings. But beauty is only skin deep. As with relationships and leaked NSA documents, we quickly discover that what’s on the inside is just as, if not more, important….
Server Side Request Forgery (SSRF)
A Server Side Request Forgery (SSRF) attack gives an attacker the ability to use your web application to send requests to other applications running on the same machine, or to other servers which can be on the same or on a remote network. Since the…
Automatic detection of XXE vulnerabilities in OpenID implementations using Acunetix AcuMonitor
Reginaldo Silva recently uncovered a very interesting bug affecting Facebook (and received $33,500 for this discovery). The bug is caused by improper handling of XML documents in OpenID implementations causing XML External Entity Expansion vulnerabilities. He mentioned in his article that many OpenID implementations/libraries are…
Acunetix Web Vulnerability Scanner v9, build 20140206 includes several new tests for vulnerabilities on well-known web applications
Acunetix Web Vulnerability Scanner version 9, build 20140206 is able to scan WordPress more efficiently, and includes various new checks for vulnerabilities in well-known systems such as MediaWiki, IBM Web Content Manager, Joomla! and Oracle. New Functionality in Acunetix Web Vulnerability Scanner v9 Added a…