2
votes

What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known vulnerabilities?

3 Answers 3

3
votes

Nikto is a good tool.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

2
  • I just tried out Nikto myself to scan a new webserver and it's very easy to set up and use. It did seem to think that the presence of a / path (and its many aliases) could indicate the existence of various troublesome programs, which was a pain to have to read through, but at least it appears to be quite thorough. Of course, the absence of a found vulnerability does not prove that there aren't any others, so I'd run as many different scanners as is feasible.
    – yukondude
    Jun 8, 2009 at 18:03
  • Thanks for the Nikto info. Very easy to run and I'm currently scanning some of my Windows IIS boxes with it as well.
    – Valien
    Feb 25, 2013 at 15:56
1
vote

Tools that will scan these type of vulnerabilities:

2
  • I used Nessus and was immediatley overwhelmed and couldn't actually get it to work what do you recommend for the programmer, who gets stuck managing a production environment?
    – JoshBerke
    May 1, 2009 at 4:42
  • If you can afford it, Qualys. It's a device that you can install in your data center in about 10-15 minutes. Setting up the scans are easy and done through a web interface. The training class is all of a day if you need it. And if necessary, you can scan your perimeter security using Qualys' external scanners. May 1, 2009 at 4:45
1
vote

A newish tool for Web Application testing is Cenzic Hailstorm It's quite extensive and will do a thorough job.

Nessus will also work quite well. You might want to read Nessus Web App Testing PDF Guide and Security Testing with Nessus

Paul Asadoorian from pauldotcom.com is the product evangelist for nessus now, so he has quite a few good posts about using nessus to perform these kinds of tests.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .