Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known vulnerabilities?


locked by HopelessN00b Dec 5 '14 at 5:44

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

up vote 3 down vote accepted

Nikto is a good tool.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

I just tried out Nikto myself to scan a new webserver and it's very easy to set up and use. It did seem to think that the presence of a / path (and its many aliases) could indicate the existence of various troublesome programs, which was a pain to have to read through, but at least it appears to be quite thorough. Of course, the absence of a found vulnerability does not prove that there aren't any others, so I'd run as many different scanners as is feasible. – yukondude Jun 8 '09 at 18:03
Thanks for the Nikto info. Very easy to run and I'm currently scanning some of my Windows IIS boxes with it as well. – Valien Feb 25 '13 at 15:56

Tools that will scan these type of vulnerabilities:

I used Nessus and was immediatley overwhelmed and couldn't actually get it to work what do you recommend for the programmer, who gets stuck managing a production environment? – JoshBerke May 1 '09 at 4:42
If you can afford it, Qualys. It's a device that you can install in your data center in about 10-15 minutes. Setting up the scans are easy and done through a web interface. The training class is all of a day if you need it. And if necessary, you can scan your perimeter security using Qualys' external scanners. – K. Brian Kelley May 1 '09 at 4:45

A newish tool for Web Application testing is Cenzic Hailstorm It's quite extensive and will do a thorough job.

Nessus will also work quite well. You might want to read Nessus Web App Testing PDF Guide and Security Testing with Nessus

Paul Asadoorian from is the product evangelist for nessus now, so he has quite a few good posts about using nessus to perform these kinds of tests.


Not the answer you're looking for? Browse other questions tagged or ask your own question.