What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known vulnerabilities?
3 Answers
Nikto is a good tool.
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).
-
I just tried out Nikto myself to scan a new webserver and it's very easy to set up and use. It did seem to think that the presence of a / path (and its many aliases) could indicate the existence of various troublesome programs, which was a pain to have to read through, but at least it appears to be quite thorough. Of course, the absence of a found vulnerability does not prove that there aren't any others, so I'd run as many different scanners as is feasible. Jun 8, 2009 at 18:03
-
Thanks for the Nikto info. Very easy to run and I'm currently scanning some of my Windows IIS boxes with it as well.– ValienFeb 25, 2013 at 15:56
Tools that will scan these type of vulnerabilities:
-
I used Nessus and was immediatley overwhelmed and couldn't actually get it to work what do you recommend for the programmer, who gets stuck managing a production environment? May 1, 2009 at 4:42
-
If you can afford it, Qualys. It's a device that you can install in your data center in about 10-15 minutes. Setting up the scans are easy and done through a web interface. The training class is all of a day if you need it. And if necessary, you can scan your perimeter security using Qualys' external scanners. May 1, 2009 at 4:45
A newish tool for Web Application testing is Cenzic Hailstorm It's quite extensive and will do a thorough job.
Nessus will also work quite well. You might want to read Nessus Web App Testing PDF Guide and Security Testing with Nessus
Paul Asadoorian from pauldotcom.com is the product evangelist for nessus now, so he has quite a few good posts about using nessus to perform these kinds of tests.