5 ms·
Are there tools that automatically do all, or most, of this and present the data in a nice GUI?
by flanbiscuit 9y ago
Are there tools that automatically do all, or most, of this and present the data in a nice GUI?
- thaumasiotes 9y agoYes. People running these tools are so common that "automated reports" are routinely excluded from public bug bounty programs. The ratio of false findings to true findings is very high.
- mieseratte 9y ago> The ratio of false findings to true findings is very high. Had to deal with one of these canned reports a while back to satisfy some enterprise contract. Had a dozen or so JS "vulns" that were only applicable to a Node environment that were being reported for client-side use. We were not a Node shop. I couldn't believe we'd paid money for that garbage report.
- libdjml 9y agoYes, very poorly.
- gerdesj 9y agoThere are plenty of companies offering that for a price - search for PCI DSS compliance checking. For DIY, then start with Kali Linux - you get the whole suite of tools but be prepared to do some learning and it is non trivial, especially if you are unfamiliar with Unix. You do get a mostly working OpenVAS with the Greenbone webby frontend nearly out of the box, but it needs a bit of config https://www.kali.org/penetration-testing/openvas-vulnerability-scanning/ https://www.kali.org/penetration-testing/openvas-vulnerabili... is a bit out of date. Even once you get it working, you have to be prepared to evaluate the output. Also bear in mind that security means different things to different people and different systems. There is, and never can be, a magic security bullet.