I pointed it at my lighttpd server and all I got was "cannot detect software" or so.
Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
21–30 of 50 posts
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#22Is there an open source alternative that could be self-hosted and configured to run automated and periodical checks?
Metasploit? You don't even need to host it (why are we so obsessed with making everything a website?)
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#23This is a nice addendum to the "Let Us Identify Your Stack" style web services tho I guess some of them might already provide this. It does have the somewhat negative effect of making potentially vulnerable websites more visible to lower order hackers (I'm assuming more proficient ones have automated discovery tools like this anyway).
There are browser extensions that do this same thing. It's pretty trivial to do.
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#24It’s a pretty poor implementation that is basically matching on the lowest common denominator, by platform rather than by library or framework. An ASP.NET website is fully independent of a WCF vulnerability. They can coexist but definitely don’t have to.
Additional suggestion: many times the home page is a link to many different technologies. Crawl all first-level directory indices to see different techs. E.g. we have a xenforo-powered forum at /forums, a WordPress blog at /blog, a custom ASP.NET CMS at /store, a .NET Core web app at /foo, etc.
The domain index for most companies past a certain age/size not dedicated solely to a single app effectively turns into a static html page.
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#25Finally, a place that can gather IP addresses and associate them to specific security products to have them hacked later. Just what I've been waiting for.
Why do you think this is any easier than just scraping urls off the internet
I'm always surprised by the mindset of the person you're replying to.
I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that).
Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk, correlate, etc. is ever-increasing.
[0] At least, I think that was the conference.
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#26Earlier quoted context omitted.
Why do you think this is any easier than just scraping urls off the internet
I'm always surprised by the mindset of the person you're replying to. I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that). Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk…
In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#27Earlier quoted context omitted.
I'm always surprised by the mindset of the person you're replying to. I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that). Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk…
In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan
Yes, thank you, I think that was the one. Only missed by an order of magnitude or so.
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#28Finally, a place that can gather IP addresses and associate them to specific security products to have them hacked later. Just what I've been waiting for.
Wait until you hear about shodan...
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#29I pointed it at my lighttpd server and all I got was "cannot detect software" or so.
yep that's what I got. Tried on a couple of my web apps.
Re: Show HN: Enter your URL and view CVEs affecting your stack over last 6 months
#30Is there an open source alternative that could be self-hosted and configured to run automated and periodical checks?
Metasploit? You don't even need to host it (why are we so obsessed with making everything a website?)
The key part is automation, not a website. Make it part of your ci/cd pipeline.