Contents
How do you perform a vulnerability assessment on a website?
Only if you have access to the DNS server of that domain and look at the zone file can you see ALL the subdomains.
- Find Virtual Hosts [also optional]
- Run the TCP Port scanner.
- Use the Website Scanner.
- Perform a Password Audit.
- Run the Network Vulnerability Scanner with OpenVAS.
- Check the SSL/TLS [optional]
What are the vulnerability assessment profile?
A vulnerability assessment is a systematic review of security weaknesses in an information system. It evaluates if the system is susceptible to any known vulnerabilities, assigns severity levels to those vulnerabilities, and recommends remediation or mitigation, if and whenever needed.
What to look for in a website vulnerability assessment?
The Website Scanner finds common vulnerabilities that affect web applications, such as SQL Injection, XSS, OS Command Injection, Directory Traversal, and others. The scanner also identifies specific web server configuration issues. We recommend using the Light Scan if you don’t want to raise any alarms.
How can I scan my website for vulnerabilities?
This free scan gives you access to a trial period during which you can scan your website for vulnerabilities against a wide range of security holes, top CVE’s and fingerprints. While their scan runs a bit more slowly than the others, it’s deep, thorough and lets you spot the hidden vulnerabilities in your code, server and network.
What can you do with a website security test?
The Website Security Test is a free online tool to perform web security and privacy tests: Non-intrusive GDPR compliance check related to web application security. Non-intrusive PCI DSS compliance check related to web application security. Analysis of CMS and its components for outdated versions and publicly-known vulnerabilities.
Is there a light version of vulnerability scanner?
The Light version of the Website Vulnerability Scanner performs a passive web security scan to detect issues like: outdated server software, insecure HTTP headers, insecure cookie settings and a few others (see the complete list of tests below).