Rapid 7 is better, nothing stored off site.

Best Regards,

Lawrence Pingree

On Nov 30, 2009, at 9:52 PM, Erik Ilves <green.boy (at) mail (dot) ee [email concealed]> wrote:

Hey John,

I haven't evaluated myself because i love my nessus scanner, but I've heard good things about http://www.qualys.com/

B r,

Erik

On 25.11.200

[ more ]  [ reply ]

Hello, web security researchers!

There is well known methodology for auditing security of web
applications called OWASP Testing Guide [0], but it describes testing
procedures for only web applications, not for, like, complex
applications (for example, containing application servers, application
gat

[ more ]  [ reply ]

I'm currently evaluating some commercial scanners and wanted to get a
feel for others experiences with appscan/cenzic/webinspect. Any
gotcha's with any of these products and can anybody recommend one over
the other?

thanks,
John

This list is sponsored by Cenzic
-----------------------------

[ more ]  [ reply ]

------------------------------------------------------------------------
--------
YOU'RE INVITED: IT SECURITY ON DEMAND WEBCAST

"Replicating the Gonzalez Cyber Attacks through Penetration Testing"
Register: http://www.coresecurity.com/Form/generic/campaign/SecurityFocusGonzalez
--------------------

[ more ]  [ reply ]

Dear all,

After a long break and a lot of Unpolished SITA releases of the previous version,
I am finally releasing winAUTOPWN version 2.0

winAUTOPWN or WINDOWS AUTOPWN version 2.0 now has a GUI (winAUTOPWN_GUI.exe) to initiate the main
console winAUTOPWN.exe
winAUTOPWN now supports all console ar

[ more ]  [ reply ]

**************************************************************
Application: Snitz Forums 2000
Version affected: 3.4.07
Website: http://forum.snitz.com/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi (at) gmail (dot) com [email concealed]
Web: http://www.andreafabrizi.it
Vuln: Multiple Cross-Site Scripting
****************

[ more ]  [ reply ]

Bonsai Information Security - Advisory
http://www.bonsai-sec.com/research/

Multiple XSS in Achievo

1. *Advisory Information*

Title: Multiple XSS in Achievo
Advisory ID: BONSAI-2009-0101
Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/ach

[ more ]  [ reply ]

Pentaho 1.7.0.1062 Multiple Vulnerabilities

 Name Multiple Vulnerabilities in Pentaho
 Systems Affected Pentaho <= 1.7.0.1062
 Severity High
 Impact (CVSSv2) High 7/10, vector: (AV:N/AC:L/Au:S/C:P/I:C/A:P)
 Vendor http://www.pentaho.com
 Advisory http://antisnatchor.com/2009/06/20/pentaho-1701062-m

[ more ]  [ reply ]

Bonsai Information Security - Advisory
http://www.bonsai-sec.com/research/

SQL Injection in Achievo

1. *Advisory Information*

Title: SQL Injection in Achievo
Advisory ID: BONSAI-2009-0102
Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/ac

[ more ]  [ reply ]

Eclipse BIRT <= 2.2.1 Reflected XSS

Vendor: Eclipse
Advisory: http://antisnatchor.com/2008/12/18/eclipse-birt-reflected-xss/
Author: Michele "euronymous" Orrù (euronymous AT antisnatchor DOT com)

Quite a common problem in a lot of Java based applications: reflected
XSS in Java stack trace.

A Ref

[ more ]  [ reply ]

The Web Application Security Consortium (WASC) is pleased to announce
the WASC Web Application Security Statistics Project 2008. This
initiative is a collaborative industry wide effort to pool together
sanitized website vulnerability data and to gain a better understanding
about the web application

[ more ]  [ reply ]

The Web Application Security Consortium is pleased to announce the release
of version 1 of the Web Application Security Scanner Evaluation Criteria
(WASSEC). The goal of the WASSEC project is to create a vendor-neutral
document to help guide information security professionals during web
applicati

[ more ]  [ reply ]

FBController - The Ultimate Utility to Control Facebook accounts without the
Password.

Let me clear this again like last time that this utility WON'T hack/crack Facebook accounts.
The utility will need biscuits/cookies instead of the password.

Get the target's cookie by sniffing, XSS, social engi

[ more ]  [ reply ]

Hi All,

The link <http://support.microsoft.com/kb/935834> is the step the How to
enable LDAP signing in Windows Server 2008.

How to enable LDAP signing on client side?

Thanks,

Jianrong Yu
Systems Operation
Office of Information technology
Ohio University

[ more ]  [ reply ]

Hi,
Can anybody tell me how to run ratproxy from windows comand prompt,without
installing cygwin.
--
View this message in context: http://www.nabble.com/Running-ratproxy-from-windows-command-prompt-witho
ut-installing-cygwin-tp25380915p25380915.html
Sent from the Web App Security mailing list archi

[ more ]  [ reply ]

Calling all greyhats, whitehats, blackhats, rainbowhats, nohats,
underground, aboveground, in-the-sky, on-the-moon, Grannies,
Grandpas, martians, Doodhwalas, Kaamwalis, Bai, Bhai, Chuck norris Fans,
Mithun Da Fans, Himesh Reshamiya wannabees??..

Call For Paper is officially open for nullcon Goa 201

[ more ]  [ reply ]

So I've been an observer of the "Web 2.0 is a security nightmare" camp
with the occasional head nods and detached agreement, being enough of a
generalist that I didn't have anything to add to the alarms raised by the
specialists. Where is the support group for those who have recently
realized just

[ more ]  [ reply ]