Tag: Cybersecurity

Business

Nessus – Free Security Scanner

Overview Nessus is a proprietary vulnerability scanner developed by Tenable. It is a free security scanner that can assess the modern attack surface and find vulnerabilities. It also uses the CVE architecture for easy cross-linking between compliant security tools. Nessus has multiple scanning options such as: Hosts discovery Basic network scan  Web application scan Advance Scan Malware Scan etc In this article, we will discuss how to install and use Nessus. We will also discuss its configurations and automation abilities. Nessus Installation (Kali Linux) Nessus is compatible with Linux and Windows Operating systems. This installation guide will be done on a Kali Linux machine. To use Nessus, you need an activation code. This can be acqu...
Business

DNS Blacklists – Block Spam and Malicious Entities

Overview DNS blacklists are a database that holds a list of IP address or URLs of spam emails and malicious websites and more. They are used to filter out spam and malicious websites from reaching end users. For example, they are usually used by ISPs or mail servers to prevent spam from getting to their users. There are hundreds of DNS blacklists that exist and spam is only one type of DNS blacklist. There are many types of DNS blacklists such as: Spam Image Spam Malware/Virus Phishing Botnet Compromised Machines Bogon etc Some DNS blacklists are even country-based. In this article, we will discuss how to use DNS blacklists and how they can improve the security of your network. Type of DNSblacklists How to use a DNS Blacklist To check if th...
WhatWeb – Website Technology Identifier
Business

WhatWeb – Website Technology Identifier

Overview WhatWeb is an open-source reconnaissance tool capable of identifying the technology of a website. It recognises web technologies including content management systems (CMS), JavaScript libraries, web servers, statistic/analytics packages, blogging platforms and more. It has over a thousand plugins to recognise software versions, frameworks, email addresses, errors and etc. WhatWeb not only identifies the technology found but also describes it, which is great as not everyone understands the technology identified. Here is the list of features WhatWeb contains: Over 1700 plugins Control the trade-off between speed/stealth and reliability Plugins include example URLs Performance tuning. Control how many websites to scan concurrently. Multiple log formats: Br...
Business

DNSenum – DNS Information Gathering

Overview Dnsenum is an open-source DNS information gathering tool to find DNS information of a domain and discover non-contiguous IP blocks. Its main purpose is to gather as much information as possible about a domain. DNSenum is scripted in Perl that also supports multithreading to speed up the scans. Its features are: Get the host’s addresses (A record). Get the name servers (threaded). Get the MX record (threaded). Perform axfr queries on nameservers and get BIND versions(threaded). Get extra names and subdomains via google scraping (google query = “allinurl: -www site:domain”). Brute force subdomains from a file. can also perform recursion on subdomains that have NS records (all threaded). Calculate C class domain network ranges and perform whois querie...
Top Cyber Threats E Commerce Sites Facing This Holiday Season
Business, Risk, Security

Top Cyber Threats E Commerce Sites Facing This Holiday Season

Any e-commerce company must provide a good consumer experience. This holiday season, a lot is on the line for those businesses. Digital Commerce 360 predicts that during the 2022 holiday shopping season, roughly $1 of every $4 will be spent online, generating $224 billion in e-commerce sales. It's crucial to make sure your e-commerce site is secure in order to make sure it is prepared for the Christmas rush. While security and safety are key issues for companies of all sizes, they are particularly crucial for those who work in the e-commerce industry. Many websites integrate third-party technologies at every stage of the customer journey in order to provide the experience that customers need. In fact, several e-commerce companies rely on their collection of third-party plugins to estab...
Business

Optimizing ZAP Scan

Overview Is your ZAP scan taking hours to complete? Maybe even a day to two? Not everyone has the luxury to wait for a 24hr ZAP scan to complete. This is the problem many people face and is what we will be tackling. In this article, we will discuss the variables that affect the duration of the scan and optimise zap scans. Optimise Zap Scans - What Affects a ZAP Scan? Server Hardware and network are one factor that affects the speed of a ZAP scan. So you could get better equipment, but the target equipment is also another factor that we can't control. Thus, let's focus on the configuration of the ZAP application itself. When running an automated scan, there are 2 things that occur, the spidering (which is also part of the passive scan) and the active scan. Each of these co...
Business

ZAP Command Line

ZAP is mostly executed from the GUI, but ZAP can also be executed from the command line. This is great if you want to run a quick scan on your target or want to automate it. If you haven't read How to use OWASP ZAP - Open Source Vulnerability Scanner, I suggest you read it first to have a better understanding of ZAP before moving on to the command line. ZAP Command Line (CLI) Executing ZAP from the command line is limited as you will not be able to specify anything using the command line arguments alone. This means you may not be able to use other scanning features such as fuzzing, ajax spidering, brute force, etc. You can specify some variables by using the -autorun command with an automation file from the automation framework. You can read more about that in How to Autom...
Business

How to use OWASP ZAP – Open Source Vulnerability Scanner

Overview OWASP ZAP is an open-source web application vulnerability scanner that runs on Java11+. It has features such as spidering, passive scanning, active scanning, fuzzing, automation, API and more. ZAP is available on operating systems such as Windows, Linux, Mac and cross platforms. You can download ZAP from here. If you are using Kali Linux, it comes preinstalled. In this article, we will discuss how to use ZAP, its features and results to take note of. How to use ZAP ZAP can be executed through the Automated Scan or the Manual Explore option. Automated Scan This method is an automatic scan. It is the main feature of ZAP. First, enter the URL to attack, and select a spider to use (traditional or ajax). Next, click attack and let it run to comp...
Business

Ffuf – URL Directory Finder/Fuzzer

Overview Ffuf (Fuzz Faster U Fool) is a URL Fuzzer (a.k.a. URL Directory Finder/Browser). This tool can discover hidden, sensitive or vulnerable files and routes in web applications and servers. Essentially, you give the tool a wordlist and it will brute force directories, showing if it is a valid directory or not. And conveniently, it comes preinstalled on Kali Linux installations. Some tools you may be similar to Ffuf are : Wfuzz (very similar to Ffuf) Dirb (single thread only) Dirbuster (has a GUI but often crashes) Gobuster Generally, they all do the same thing, with slight differences like: The reliability of the tool (the tool crashing) The efficiency of the tool (single thread vs multi-thread) The options provided (filtering capabilities) Th...