Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Check for web application security issues.

webscanservice.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Show HN: Check for web application security issues.

#21

Post by tptacek »

I can see you're not really selling to an informed audience (and that's fine!) but I really think you want to sacrifice some of the Google-like simplicity of your front page to explain what, exactly, you're testing on target sites.

Some reasons to at least give broad strokes about how you're testing:

(i) Testing for some kinds of web flaws is inherently intrusive; for instance, it's very hard to reliably test for stored XSS without potentially disrupting an application for users.

(ii) Aggressive spidering will create performance issues for some clients, and "oh well you should have known better" isn't going to stanch the PR bleeding when you take someone's site down.

(iii) If you're doing authz testing, you will eventually find a site where a post-auth crawl will delete huge swaths of database entries because someone implemented "delete" as a vanilla GET link.

(iv) (To me, the most important) Lots of uninformed clients will run something like this and feel confident they've checked the "security" part of their deployment checklist; without knowing exactly what you're testing for (and ideally being up front about the things you don't test for), you can give clients a really dangerous false confidence.

Re: Show HN: Check for web application security issues.

#22

Post by shakesbeard »

borski wrote: post #20
shakesbeard wrote: post #19

FYI: Seems to work now.

Have you actually gotten any results? I just get a nav bar with nothing in any of the tabs.

Yes. Just wait some minutes. I guess the server is under heavy load.

Got some false positives though. For example "PHP Admin Application" and "PHP Debug Application" for files /admin.php and /debug.php which both do not exist actually.

Re: Show HN: Check for web application security issues.

#24

Post by Natsu »

tptacek wrote: post #21

I can see you're not really selling to an informed audience (and that's fine!) but I really think you want to sacrifice some of the Google-like simplicity of your front page to explain what, exactly, you're testing on target sites. Some reasons to at least give broad strokes about how you're testing: (i) Testing for some kinds of web flaws is inherently intrusive; for instance, it's very hard to reliably test for sto…

You're absolutely right. It's important for people to know what you're testing. Point (iii) in particular is all too real:

http://thedailywtf.com/Articles/The_Spider_of_Doom.aspx

Re: Show HN: Check for web application security issues.

#26

Post by jay_l »

tptacek wrote: post #21

I can see you're not really selling to an informed audience (and that's fine!) but I really think you want to sacrifice some of the Google-like simplicity of your front page to explain what, exactly, you're testing on target sites. Some reasons to at least give broad strokes about how you're testing: (i) Testing for some kinds of web flaws is inherently intrusive; for instance, it's very hard to reliably test for sto…

I agree with this. I think many users won't be willing to go through with the verification step unless they have some clue about what this site actually does.

After all, you're targeting users who, even if they aren't incredibly informed, at least have enough technical savvy to be running a site.

Re: Show HN: Check for web application security issues.

#27

Post by borski »

swalberg wrote: post #8
pors wrote: post #2

> Please create a "webscan.html" file with the content "scanme" I advice you to make the contents of this file unique for each website, otherwise: - i can check 1000s of sites for the existence of webscan.html - enter the sites that have such a file - see the vulnerabilities of sites I don't own.

I think you mean the file name, not the contents.

Actually, filename wouldn't work because some sites just return 200 instead of a 404, against the standards.
Post reply on HN