3 ms·

I just scanned my personal site. It came back saying 1 directory traversal problem and 1 interesting file, and that if I wanted to find out what they were, I'd

I just scanned my personal site. It came back saying 1 directory traversal problem and 1 interesting file, and that if I wanted to find out what they were, I'd have to pay. And good grief, there's a lot of text there. To me, that just seems scammy. As in "click here for your free credit report... oh! We've found problems. Pay to see what they are!" Looking through my web server logs I'm not quite sure what the problems are, or how you determined I had the problem. Did I maybe return an error message with a 200 status code instead of a 403 forbidden? I've got some redirects on my site, did you take the 301 as a bad sign? Looks like you're using skipfish for the scanning engine? Who is your target market? I could see companies using something like this to fill the box on PCI compliance, but would need a lot more control over the report (eg "get rid of that low category") and would need a lot more details about how the scan was performed in order to satisfy an auditor. People who just want to display a seal on their signup page will want something a lot more low key, and already have lower cost options.

swalberg 16y ago
Just to follow up on myself, I installed skipfish and ran it against my site in the easiest mode (./skipfish -W /dev/null -LV -o rpt http://example.com http://example.com) * I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry. * Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.
Goiem 16y ago
Thanks for the feedback! I have been considering alternate tactics, such as showing low/medium risk issues but not high risk, or just selling the free scan as a high level scan which doesn't complete any in depth testing. Yes, I use skipfish for some tests, though I customized parts of it (it has an amazing web crawler). I also use proprietary scan technology, and plan to add a few more open source tools into the mix (such as port/service and virus scanning) in the not so distant future to create one combined risk/vulnerability report. interesting file is typically a text file, unsecured htaccess file, or sometimes 500 error messages. If you tell me your site, I will check for you. target market is small business, medium size business, or individual site owners - mostly those who don't maintain a full time IT security staff but want some visibility into their site risks. Eventually I may add PCI checks, but that is a huge compliance/paper cost which is tough for a one man shop to keep up with.

swalberg 16y ago

Just to follow up on myself, I installed skipfish and ran it against my site in the easiest mode (./skipfish -W /dev/null -LV -o rpt http://example.com http://example.com) * I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry. * Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.

Goiem 16y ago

Thanks for the feedback! I have been considering alternate tactics, such as showing low/medium risk issues but not high risk, or just selling the free scan as a high level scan which doesn't complete any in depth testing. Yes, I use skipfish for some tests, though I customized parts of it (it has an amazing web crawler). I also use proprietary scan technology, and plan to add a few more open source tools into the mix (such as port/service and virus scanning) in the not so distant future to create one combined risk/vulnerability report. interesting file is typically a text file, unsecured htaccess file, or sometimes 500 error messages. If you tell me your site, I will check for you. target market is small business, medium size business, or individual site owners - mostly those who don't maintain a full time IT security staff but want some visibility into their site risks. Eventually I may add PCI checks, but that is a huge compliance/paper cost which is tough for a one man shop to keep up with.