Vulnerability Scanning is a low cost solution for businesses wanting a lightweight security check up on their computer systems, networks or web applications. This type of assessment will uncover “low hanging fruit” security misconfigurations such a missing patch levels.
What is Vulnerability Scanning?
A Vulnerability Scan will audit for “low hanging fruit” vulnerabilities against external facing infrastructure or web application. The assessment will discover the following type of vulnerabilities:
Brief Overview of a standard scan:
Key Benefits Of A Vulnerability Scan
Vulnerability Scans can be used to give a quick check of your infrastructure. System admins may decide to request a vulnerability scan to ensure there system has been patched correctly:
A Vulnerability Scan will help our clients:
Our consultants are all certified with at least Check Team Member or OSCP certificate. We follow the industry-standard OSSTMM methodology. Alongside this, we use our own in-house methodologies which have been tried and tested during our own careers.
Using industry specific scanning tools we will audit your web application or external infrastructure for the latest vulnerabilities.
Penetration Testing Engagement Process
Authenticated Stored XSS in NinjaForms Settings Page (Version 3.4.22 ) Background A Spider Sec Ltd consultant discovered an Authenticated Stored XSS vulnerability inside the Ninja forms WordPress Plugin which could allow attackers to hi-jack administrative cookies if an attack is coupled together with a phishing campaign. Technical Details The following parameters are vulnerable […]
Registration Magic Version 184.108.40.206 (Multiple XSS Vulnerabilities) Background After discovering two new WordPress Plugin vulnerabilities on a recent web application penetration test (which were authenticated and difficult to weaponise) I decided to go in search for some higher ticket WordPress Plugin vulnerabilities in my spare time. I started downloading registration form and forum building plugins, […]
Registration Magic Version 220.127.116.11 Authenticated Blind SQL Injection in URL Background If you still haven’t read the preface to this discovery please take a look here. Technical Details Authenticated SQL Injection in Form_id field The form_id field takes input from a number of in the front end and processes it on […]
Calculated Fields Form WP Plugin (Version <= 1.0.353) Multiple Authenticated Stored XSS Background The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These Calculated Fields Form vulnerabilities were discovered during a web application penetration test by a Spider Sec Ltd Consultant. Technical Details An […]