Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
2

What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known vulnerabilities?

share|improve this question

3 Answers

up vote 3 down vote accepted

Nikto is a good tool.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

share|improve this answer
I just tried out Nikto myself to scan a new webserver and it's very easy to set up and use. It did seem to think that the presence of a / path (and its many aliases) could indicate the existence of various troublesome programs, which was a pain to have to read through, but at least it appears to be quite thorough. Of course, the absence of a found vulnerability does not prove that there aren't any others, so I'd run as many different scanners as is feasible. – yukondude Jun 8 '09 at 18:03
Thanks for the Nikto info. Very easy to run and I'm currently scanning some of my Windows IIS boxes with it as well. – Valien Feb 25 at 15:56
up vote 1 down vote

Tools that will scan these type of vulnerabilities:

share|improve this answer
I used Nessus and was immediatley overwhelmed and couldn't actually get it to work what do you recommend for the programmer, who gets stuck managing a production environment? – Josh May 1 '09 at 4:42
If you can afford it, Qualys. It's a device that you can install in your data center in about 10-15 minutes. Setting up the scans are easy and done through a web interface. The training class is all of a day if you need it. And if necessary, you can scan your perimeter security using Qualys' external scanners. – K. Brian Kelley May 1 '09 at 4:45
up vote 1 down vote

A newish tool for Web Application testing is Cenzic Hailstorm It's quite extensive and will do a thorough job.

Nessus will also work quite well. You might want to read Nessus Web App Testing PDF Guide and Security Testing with Nessus

Paul Asadoorian from pauldotcom.com is the product evangelist for nessus now, so he has quite a few good posts about using nessus to perform these kinds of tests.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.