Contents
Which of the following vulnerabilities can be detected by Acunetix AcuMonitor?
Vulnerabilities Detected by AcuMonitor An Acunetix scan makes use of AcuMonitor to detect certain vulnerabilities such as Blind XSS, Email Header Injection, and certain types of SSRF, XXE and Host Header Attacks. AcuMonitor can only detect some of these vulnerabilities after the scan has finished.
What is HTTP Host header attack?
HTTP Host header attacks exploit vulnerable websites that handle the value of the Host header in an unsafe way. If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior.
What is the impact of Host header attack?
Impact: Tampering of Host header can lead to the following attacks: 1) Web Cache Poisoning-Manipulating caching systems into storing a page generated with a malicious Host and serving it to others.
What does the Host header do?
The Host request header specifies the host and port number of the server to which the request is being sent. If no port is included, the default port for the service requested (e.g., 443 for an HTTPS URL, and 80 for an HTTP URL) is implied. A Host header field must be sent in all HTTP/1.1 request messages.
How is AcuMonitor enabled?
AcuMonitor is a publicly accessible service. It waits for two types of connections: connections from your web application after processing an Acunetix vulnerability payload and connections from your Acunetix scanner (online or on-premise).
How do I run Acunetix?
Installation on Windows
- Download the latest Windows version of Acunetix from the download location provided when you purchased the license.
- Double click the installation file to launch the Acunetix installation wizard and click Next when prompted.
- Review and accept the License Agreement.
How does the acunetix web application vulnerability report work?
Every year, Acunetix crunches data compiled from Acunetix Online into a vulnerability testing report that portrays the state of the security of web applications and network perimeters. This year’s report contains the results and analysis of vulnerabilities detected over the previous 12 months, across 10,000 scan targets.
How does acunetix solve a host header attack?
Acunetix solves this by making use of AcuMonitor as its intermediary service during an automated scan. During a scan, Acunetix will locate the password reset page and inject a custom host header pointing to an AcuMonitor domain.
How can I detect a host header attack?
The most efficient way to detect Host header vulnerabilities is by using a professional web vulnerability scanner such as Acunetix. Acunetix will not only detect all kinds of vulnerabilities and misconfigurations but will also suggest ways to resolve them and you can use it to manage the repair process.
How does an IAST scan work in acunetix?
An IAST scan means that the scanner has “insider information” about the web application. In Acunetix, this is possible thanks to AcuSensor technology. You install AcuSensor agents on the web server for Java, ASP.NET, and PHP applications. The agents send information from the web server back to the scanner.