0

Some time ago I ran across a script that reported outdated/insecure versions of Joomla, Drupal, WordPress, OS Commerce, etc on a server. It did this by traversing the file system and looking for common signatures in them. Now I cannot find it, though I would both like to use and contribute to it.

The perfect use case would be a server that you are asked to "secure" with hundreds of user uploaded sites (not likely patched or maintained). Or a shared server a previous admin is turning over to you, which you want to identify old packages before the get hacked.

Any suggestions, or ideas? My numerous searches turn up mostly penetration testers, where as I want something that looks at the filesystem for outdated or vulnerable packages.

2
  • From reading your question I get the impression that when you say "packages" you're talking about web apps exclusively. Is that correct or are you after something more comprehensive? e.g. Checking the versions of all the bits that make up the system, including things like Apache, PHP, etc., etc. Jan 6, 2012 at 2:23
  • Right, it's Joomla, PHPMysql, and the other really common OSS PHP apps that I'd really like a tool to easily sniff out.
    – Matt
    Jan 6, 2012 at 18:22

1 Answer 1

1

turn the problem around slightly and use what an attacker or pentester would use - get metasploit or nessus and scan your machine, see what is on there (of any version) that is vulnerable (sometimes the latest stable is still vulnerable). Just because you have the latest package doesn't mean you're safe, unfortunately.

(if you're running a RedHat-derived system, you should be able to use something like "yum update" in dry-run mode to show you what would be updated if you did it for real. Debian's apt has a similar functionality.)

2
  • I'm assuming the disto-provided tools are updated with vendor provided tools. I guess nobody has seen this script, which is unfortunate because I think was a great way to search for commonly exploited code on the filesystem, rather than just remotely through pen-test tools.
    – Matt
    Jan 6, 2012 at 18:21
  • this page has a list of package vulnerability audit systems for various OSes: draft.scyphus.co.jp/audit.html (BSD wins, not surprisingly :)). If you're using Debian, try this: debian.org/doc/manuals/securing-debian-howto/…. Looks like Tiger (from the debian URL) may be useful on RedHat systems as well (see www.sans.org/score/checklists/AuditingLinux.doc)
    – darkuncle
    Jan 6, 2012 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .