Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Some time ago I ran across a script that reported outdated/insecure versions of Joomla, Drupal, WordPress, OS Commerce, etc on a server. It did this by traversing the file system and looking for common signatures in them. Now I cannot find it, though I would both like to use and contribute to it.

The perfect use case would be a server that you are asked to "secure" with hundreds of user uploaded sites (not likely patched or maintained). Or a shared server a previous admin is turning over to you, which you want to identify old packages before the get hacked.

Any suggestions, or ideas? My numerous searches turn up mostly penetration testers, where as I want something that looks at the filesystem for outdated or vulnerable packages.

share|improve this question
    
From reading your question I get the impression that when you say "packages" you're talking about web apps exclusively. Is that correct or are you after something more comprehensive? e.g. Checking the versions of all the bits that make up the system, including things like Apache, PHP, etc., etc. –  John Gardeniers Jan 6 '12 at 2:23
    
Right, it's Joomla, PHPMysql, and the other really common OSS PHP apps that I'd really like a tool to easily sniff out. –  Matt Jan 6 '12 at 18:22
add comment

1 Answer

turn the problem around slightly and use what an attacker or pentester would use - get metasploit or nessus and scan your machine, see what is on there (of any version) that is vulnerable (sometimes the latest stable is still vulnerable). Just because you have the latest package doesn't mean you're safe, unfortunately.

(if you're running a RedHat-derived system, you should be able to use something like "yum update" in dry-run mode to show you what would be updated if you did it for real. Debian's apt has a similar functionality.)

share|improve this answer
    
I'm assuming the disto-provided tools are updated with vendor provided tools. I guess nobody has seen this script, which is unfortunate because I think was a great way to search for commonly exploited code on the filesystem, rather than just remotely through pen-test tools. –  Matt Jan 6 '12 at 18:21
    
this page has a list of package vulnerability audit systems for various OSes: draft.scyphus.co.jp/audit.html (BSD wins, not surprisingly :)). If you're using Debian, try this: debian.org/doc/manuals/securing-debian-howto/…. Looks like Tiger (from the debian URL) may be useful on RedHat systems as well (see www.sans.org/score/checklists/AuditingLinux.doc) –  darkuncle Jan 6 '12 at 19:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.