{"id":8411,"date":"2018-03-09T12:48:15","date_gmt":"2018-03-09T12:48:15","guid":{"rendered":"http:\/\/www.esds.co.in\/blog\/?p=8411"},"modified":"2021-06-25T12:42:17","modified_gmt":"2021-06-25T12:42:17","slug":"failproof-website-security-audit-mtvscan","status":"publish","type":"post","link":"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/","title":{"rendered":"Failproof website security audit with ESDS VTMScan"},"content":{"rendered":"<p style=\"text-align: justify;\"><a href=\"https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-10347 size-full\" src=\"https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1.jpg\" alt=\"website security audit with ESDS VTMScan\" width=\"1745\" height=\"480\" srcset=\"https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1.jpg 1745w, https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1-150x41.jpg 150w, https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1-300x83.jpg 300w, https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1-1024x282.jpg 1024w, https:\/\/www.esds.co.in\/blog\/wp-content\/uploads\/2018\/03\/mtvscan-1-660x182.jpg 660w\" sizes=\"auto, (max-width: 1745px) 100vw, 1745px\" \/><\/a><\/p><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_76 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#Website_security\" >Website security<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#ESDS_VTMScan_Features\" >ESDS VTMScan Features:<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#1_Domain_reputation_in_Google_SURBL_Malware_Patrol_Clean-Mx_Phishtank\" >1. Domain reputation in Google, SURBL, Malware Patrol, Clean-Mx, Phishtank:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#2_Mail_server_IP_Check_in_58_RBL_repositories\" >2. Mail server IP Check in 58 RBL repositories:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#3_Scan_SQL_Injections_for_MySQL_MSSQL_PGSQL_Oracle_databases\" >3. Scan SQL Injections for MySQL, MSSQL, PGSQL, Oracle databases:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#4_Scan_Local_file_injections_LFI\" >4. Scan Local file injections (LFI):<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#5_Scan_Remote_file_inclusion_RFI\" >5. Scan Remote file inclusion (RFI):<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#6_Scan_XSS_%E2%80%93_Cross_Site_Scripting\" >6. Scan XSS &#8211; Cross Site Scripting:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#7_Scan_Malware\" >7. Scan Malware:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#8_Detect_and_Scan_CMS\" >8. Detect and Scan CMS:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#9_Open_Port_Application_Vulnerability_detection\" >9. Open Port Application Vulnerability detection:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#10_Directory_Scanning\" >10. Directory Scanning:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#11_Detect_open_sensitive_admin_area_of_the_site\" >11. Detect open sensitive \/ admin area of the site:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#12_Scan_for_Directory_Indexing\" >12. Scan for Directory Indexing:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#13_Scan_Full_Path_disclosure_in_the_pages\" >13. Scan Full Path disclosure in the pages:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#14_Scan_Password_auto_complete_enabled_fields\" >14. Scan Password auto complete enabled fields:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#15_Information_disclosure\" >15. Information disclosure:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#16_ViewState_decoder\" >16. ViewState decoder:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#17_Scan_password_submission_method\" >17. Scan password submission method:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#18_Authenticated_area_scanning\" >18. Authenticated area scanning:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#19_Reports\" >19. Reports:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#20_Robust_Link_Crawler\" >20. Robust Link Crawler:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#21_SSL_Certificate_checking\" >21. SSL Certificate checking:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#22_Backdoor_WebShell_Locater_Client_Side_%E2%80%93_Unique_Feature\" >22. Backdoor WebShell Locater (Client Side &#8211; Unique Feature):<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#23_WebShell_Finder\" >23. WebShell Finder:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#24_Reverse_IP_domain_check\" >24. Reverse IP domain check:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#25_Deep_Application_Testing\" >25. Deep Application Testing:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#26_OWASP_Top_10\" >26. OWASP Top 10:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#27_Botnet_Monitoring\" >27. Botnet Monitoring:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#28_Defaced_Keyword_Monitoring\" >28. Defaced Keyword Monitoring:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#29_Content_Change_Monitoring\" >29. Content Change Monitoring:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-32\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#30_Schedule_based_Scan\" >30. Schedule based Scan:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-33\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#31_SSL_Check\" >31. SSL Check:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-34\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#32_Managed_by_Security_Experts\" >32. Managed by Security Experts:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-35\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#33_ESDS_VTM_Scanner_Dashboard\" >33. ESDS VTM Scanner Dashboard:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-36\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#34_Manual_Scan\" >34. Manual Scan:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-37\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#35_WAF_Detection\" >35. WAF Detection:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-38\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#36_CSRF_Detection\" >36. CSRF Detection:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-39\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#37_ClickJack_Protection_Check\" >37. ClickJack Protection Check:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-40\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#38_Page_Source_Scan\" >38. Page Source Scan:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-41\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#39_OS_Detection\" >39. OS Detection:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-42\" href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/#40_DNS_Misconfiguration\" >40. DNS Misconfiguration:<\/a><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n<h2 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"Website_security\"><\/span>Website security<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p style=\"text-align: justify;\">ESDS VTMScan is a web application security scanner having the ability to detect weakness of website\u2019s code, errors and ?nd vulnerabilities which may lead to website\u2019s data problem and security issues. In other words, it is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/esds.co.in\/security\/vtmscan\"><strong>ESDS VTMScan<\/strong><\/a> Scan OWASP Top 10 vulnerabitlies. The Open Web Application Security Project (OWASP), an online community, produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.<\/p>\n<p style=\"text-align: justify;\">ESDS VTMScan has various scanning options like SQL, LFI, RFI, XSS, and MALWARE. ESDS VTMScan also keeps an eye on your website\u2019s health by checking if it is black listed on Google, Real Time Black Hole List check (RBL), Cleanmx, Surbl, Mpatrol, Phistank (Phishing website) and generates reports for the same.<\/p>\n<p style=\"text-align: justify;\">ESDS VTMScan has a simple and easy to use scheduler which allows users to schedule a scan on daily, weekly, semi-monthly, monthly, quarterly, semiannually and annually basis with scheduled start time. Also it has a provision to manually scan the website at any desired time.<\/p>\n<p style=\"text-align: justify;\">ESDS VTMScan only scans the website and provides all vulnerability reports with recommended actions to solve or ?x those issues.<\/p>\n<h3 style=\"text-align: justify;\"><span class=\"ez-toc-section\" id=\"ESDS_VTMScan_Features\"><\/span>ESDS VTMScan Features:<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4><span class=\"ez-toc-section\" id=\"1_Domain_reputation_in_Google_SURBL_Malware_Patrol_Clean-Mx_Phishtank\"><\/span>1. Domain reputation in Google, SURBL, Malware Patrol, Clean-Mx, Phishtank:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Check whether a domain is listed with above databases. These databases and organizations stores IP address and domains which are involved in malware, spamming and phishing activities.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"2_Mail_server_IP_Check_in_58_RBL_repositories\"><\/span>2. Mail server IP Check in 58 RBL repositories:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>RBL (Real-time Black hole List) or DNSBL (DNS-based Blackhole List) is a list of IP addresses, whose owners refuse to stop the proliferation of spam. The RBL usually lists server IP addresses from ISPs whose customers are responsible for the spam and from ISPs whose servers are hijacked for spam relay.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"3_Scan_SQL_Injections_for_MySQL_MSSQL_PGSQL_Oracle_databases\"><\/span>3. Scan SQL Injections for MySQL, MSSQL, PGSQL, Oracle databases:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It is a trick that exploits poorly filtered or not correctly escaped SQL queries into parsing variable data from user input.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"4_Scan_Local_file_injections_LFI\"><\/span>4. Scan Local file injections (LFI):<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It injects files on a server through the web browser. This vulnerability occurs when a page is not properly sanitized and allows directory traversal characters to be injected.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"5_Scan_Remote_file_inclusion_RFI\"><\/span>5. Scan Remote file inclusion (RFI):<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation which can cause code execution on the web server. Code execution on the client-side such as JavaScript can lead to other attacks such as cross site scripting (XSS), DoS, Data Theft etc.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"6_Scan_XSS_%E2%80%93_Cross_Site_Scripting\"><\/span>6. Scan XSS &#8211; Cross Site Scripting:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>It is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users.<\/li>\n<li>Detects form on the Webpages and scans for GET and POST requests.<\/li>\n<li>Currently it scans for reflected XSS and we have future plans for Stored XSS. Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for use at some point in the future.\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"7_Scan_Malware\"><\/span><strong>7. <a href=\"https:\/\/esds.co.in\/security\/vtmscan\">Scan Malware<\/a><span style=\"font-size: 1.2em;\">:<\/span><\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Unique feature &#8211; Website defacement check: Website defacement is an attack on a website that changes the visual appearance of the site or a webpage.<\/li>\n<li>Forceful redirect injection test.<\/li>\n<li>Scans JavaScript code snippets against generic signatures: Checks for critical JavaScript functions like eval, base64_decode, char, etc (checks for Iframes).<\/li>\n<li>Special algorithm developed to detect JavaScript Obfuscation: Obfuscation used to convert vulnerable codes into unreadable format.<\/li>\n<li><span style=\"text-decoration: underline;\">Third party links check:<\/span> It checks third party links with reputation databases.<\/li>\n<li>Malware Monitoring primarily focuses on detection of JavaScript, iFrame &amp; Defaced keywords. JavaScript is scanned for malicious codes. The site is also scanned for deface keywords like- Hacked by etc.<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"8_Detect_and_Scan_CMS\"><\/span>8. Detect and Scan CMS:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Very few scanners provide this feature.<\/li>\n<li>Detect WordPress, Joomla, vBulletine, Drupal.<\/li>\n<li>Scan Themes, Plug-ins, unprotected admin area.<\/li>\n<li>User enumeration.<\/li>\n<li>Brut forcing for simple password detection.<\/li>\n<li>FPD &#8211; File Path Disclosure scanning.<\/li>\n<li>Detects CMS in all directories.<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"9_Open_Port_Application_Vulnerability_detection\"><\/span>9. Open Port Application <a style=\"font-size: 1.2em; font-weight: 600;\" href=\"https:\/\/esds.co.in\/security\/vtmscan\">Vulnerability detection<\/a><span style=\"font-size: 1.2em; font-weight: 600;\">:<\/span><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Administrators can use this application to switch repository of the systems and services on their network. An intruder can use banner grabbing in order to find network hosts that are running versions of applications and operating systems with known exploits.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"10_Directory_Scanning\"><\/span>10. Directory Scanning:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>The goal of this scan is to order an application to detect a computer file that is not intended to be accessible. This happens due to lack of security for directory access on the web server.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"11_Detect_open_sensitive_admin_area_of_the_site\"><\/span>11. Detect open sensitive \/ admin area of the site:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Scan for sensitive area of the sites which could not be accessible to all. e.g. Admin login pages.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"12_Scan_for_Directory_Indexing\"><\/span>12. Scan for Directory Indexing:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>When a user types in a request for a page on a website, the web server processes the request, searches the web document root directory for the default file name, and then sends this page to the user. If the server cannot find the page, it issues a directory listing and sends the output in HTML format to the user.<\/p>\n<p>This action allows the contents of unintended directory listings to be disclosed to the user because of software vulnerabilities that are combined with a specific web request. This information leak can provide an attacker with the information necessary to launch further attacks against the system.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"13_Scan_Full_Path_disclosure_in_the_pages\"><\/span>13. Scan Full Path disclosure in the pages:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot\/file. e.g.: \/home\/omg\/htdocs\/file\/. Certain vulnerabilities, such as using the load_file () (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to see.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"14_Scan_Password_auto_complete_enabled_fields\"><\/span>14. Scan Password auto complete enabled fields:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Many websites have a login form where users provide username and password. The default behavior for browsers is to allow users to store these credentials locally in the browser. Thereby, the next time a similar form appears, the username and password are already populated. With this it\u2019s easy to steal the stored passwords from user\u2019s browser.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"15_Information_disclosure\"><\/span>15. Information disclosure:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It checks for email address, IP addresses in the page.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"16_ViewState_decoder\"><\/span>16. ViewState decoder:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It detects and tries to decode viewstates.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"17_Scan_password_submission_method\"><\/span>17. Scan password submission method:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>If passwords are submitted from form using plain text, these passwords can be easily captured by sniffer utilities.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"18_Authenticated_area_scanning\"><\/span>18. Authenticated area scanning:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Scan restricted areas like admin panels, supports HTTP and Web-form based authentications.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"19_Reports\"><\/span>19. Reports:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>User receives scan completion status and reports on email. A user can also check detail reports in user control panel. Users are provided with two types of reports viz. <strong>Scan Report<\/strong> &amp; <strong>Domain Performance Report<\/strong>. Scan report shows scan details of individual domains like the number of vulnerable links found out of the total number of links. The Domain Performance Report shows several performance metrics of individual domains.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"20_Robust_Link_Crawler\"><\/span>20. Robust Link Crawler:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Crawls links from web pages, robots.txt, iframes, hacker\u2019s favorite search engines, directory indexes and directory traversals.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"21_SSL_Certificate_checking\"><\/span>21. SSL Certificate checking:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Scans a HTTPS service to enumerate what protocols and what ciphers the HTTPS service supports. It checks for weak ciphers and valid period for the certificate.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"22_Backdoor_WebShell_Locater_Client_Side_%E2%80%93_Unique_Feature\"><\/span>22. Backdoor WebShell Locater (Client Side &#8211; Unique Feature):<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Scans for shells from client\u2019s side for commonly injected locations with their usual file names.<br \/>.e.g. <span style=\"text-decoration: underline; color: #0000ff;\">http:\/\/www.example.com\/uploads\/cmd99.php<\/span><\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"23_WebShell_Finder\"><\/span>23. WebShell Finder:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Scans each web page for particular keyword so it is able to detect webshell if renamed to some other name.<br \/>e.g. <span style=\"text-decoration: underline;\"><span style=\"color: #0000ff; text-decoration: underline;\">http:\/\/www.example.com\/uploads\/myname.php<\/span><\/span> ( myname.php is webshell )<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"24_Reverse_IP_domain_check\"><\/span>24. Reverse IP domain check:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Find out all other domains hosted on the same server (Server on which scanning domain is hosted).<\/li>\n<li>Check these domains for black list.<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"25_Deep_Application_Testing\"><\/span>25. Deep Application Testing:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>In deep application scanning\/ testing, the entire website is crawled for URL\u2019s. All the URL\u2019s are completely scanned, except the ones that contain images.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"26_OWASP_Top_10\"><\/span>26. OWASP Top 10:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>OWASP stands for \u2018<strong>Open Web Application Security Project<\/strong>\u2019. OWASP releases a list of top 10 vulnerabilities every year. <strong>ESDS VTMScan<\/strong> detects each of those vulnerabilities and follows the rules laid out by OWASP.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"27_Botnet_Monitoring\"><\/span>27. Botnet Monitoring:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Attackers may hide malicious code within JS files. In Botnet Monitoring, these JS files are scanned. ESDS VTMScan also attempts to detect undetectable Java Code.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"28_Defaced_Keyword_Monitoring\"><\/span>28. Defaced Keyword Monitoring:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Attackers use different deface keywords while hacking a particular site. These deface keywords can be anything like- <strong>Pawned by<\/strong>, <strong>Owned by<\/strong> etc. These keywords can be inserted by an attacker anywhere in the site content.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"29_Content_Change_Monitoring\"><\/span>29. Content Change Monitoring:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>In Content Change Monitoring, the entire website is monitored for any changes in content. ESDS VTMScan creates a snapshot of the website and if any change in content is found, it is reported along with the percentage of change and the URL where the change were found.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"30_Schedule_based_Scan\"><\/span>30. Schedule based Scan:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>ESDS VTMScan allows users to set scan schedules for their sites on daily, weekly and monthly basis according to their requirements.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"31_SSL_Check\"><\/span>31. SSL Check:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>In SSL Check, the following areas are checked:<\/p>\n<ul>\n<li>NULL Cipher used less than 128 bits.<\/li>\n<li>Domain uses an invalid security certificate.<\/li>\n<li>Domain uses an expired security certificate.<\/li>\n<li>Domain uses a security certificate which expires today (EOD).<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"32_Managed_by_Security_Experts\"><\/span>32. Managed by Security Experts:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>ESDS VTMScan has been developed &amp; managed by security experts who have combined experience of over 5 years.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"33_ESDS_VTM_Scanner_Dashboard\"><\/span>33. ESDS VTM Scanner Dashboard:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>ESDS VTMScan dashboard is provided to clients, where they can perform functions like- domain addition, viewing reports etc.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"34_Manual_Scan\"><\/span>34. Manual Scan:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>In Manual Scan, the security experts will manually test your website for vulnerabilities (OWASP Top 10). A manual scan usually takes 4-5 days depending on the size of the site.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"35_WAF_Detection\"><\/span>35. WAF Detection:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>It checks if WAF (Website Application Firewall) exists or not. It\u2019s recommended to have WAF on the webserver to filter malicious traffic on the website.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"36_CSRF_Detection\"><\/span>36. CSRF Detection:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Detects CSRF (Cross Site Request Forgery) in websites. This vulnerability comes with XSS. This vulnerability allows the hacker to transmit malicious commands to execute on other users machine who is browsing the same site.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"37_ClickJack_Protection_Check\"><\/span>37. ClickJack Protection Check:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Checks whether page is protected against clickjack. Clickjacking (UI redressing and IFRAME overlay) is an exploit in which malicious code is hidden beneath apparently legitimate buttons or other clickable content on a website.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"38_Page_Source_Scan\"><\/span>38. Page Source Scan:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>The main purpose is to scan each page and find critical information or malwares on page. Checks for any information leakage or disclosure. Disclosure can be in form of important email id, IP address or robots.txt file. It also checks for shell files, incomplete password fields and file uploads.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"39_OS_Detection\"><\/span>39. OS Detection:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Detects web server operating system and version. Lists down all the vulnerabilities present on that particular version of operating system.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"40_DNS_Misconfiguration\"><\/span>40. DNS Misconfiguration:<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Tests whether DNS setting has been properly configured or not. Misconfigured DNS may lead to critical information disclosure like lists of subdomain and other important IP Address.<\/p>\n<div id=\"s3gt_translate_tooltip_mini\" class=\"s3gt_translate_tooltip_mini_box\" style=\"background: initial !important; border: initial !important; border-radius: initial !important; border-spacing: initial !important; border-collapse: initial !important; direction: ltr !important; flex-direction: initial !important; font-weight: initial !important; height: initial !important; letter-spacing: initial !important; min-width: initial !important; max-width: initial !important; min-height: initial !important; max-height: initial !important; margin: auto !important; outline: initial !important; padding: initial !important; position: absolute; table-layout: initial !important; text-align: justify; text-shadow: initial !important; width: initial !important; word-break: initial !important; word-spacing: initial !important; overflow-wrap: initial !important; box-sizing: initial !important; display: initial !important; color: inherit !important; font-size: 13px !important; font-family: X-LocaleSpecific, sans-serif, Tahoma, Helvetica !important; line-height: 13px !important; vertical-align: top !important; white-space: inherit !important; left: 239px; top: 1957px; opacity: 0.5;\">\n<div id=\"s3gt_translate_tooltip_mini_logo\" class=\"s3gt_translate_tooltip_mini\" title=\"Translate selected text\">\u00a0<\/div>\n<div id=\"s3gt_translate_tooltip_mini_sound\" class=\"s3gt_translate_tooltip_mini\" title=\"Play\">\u00a0<\/div>\n<div id=\"s3gt_translate_tooltip_mini_copy\" class=\"s3gt_translate_tooltip_mini\" title=\"Copy text to Clipboard\">\u00a0<\/div>\n<style type=\"text\/css\" media=\"print\">#s3gt_translate_tooltip_mini { display: none !important; }<\/style><\/div>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Website security ESDS VTMScan is a web application security scanner having the ability to detect weakness of website\u2019s code, errors and ?nd vulnerabilities which may lead to website\u2019s data problem and security issues. In other words, it is a program which communicates with a web application through the web front-end in order to identify potential&#8230; <\/p>\n<div class=\"clear\"><\/div>\n<p><a href=\"https:\/\/www.esds.co.in\/blog\/failproof-website-security-audit-mtvscan\/\" class=\"gdlr-button small excerpt-read-more\">Read More<\/a><\/p>\n","protected":false},"author":41,"featured_media":8415,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1271],"tags":[1599,1591,1593,1596,1594,1592,1595,1590,1597,1598,1589],"class_list":["post-8411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-2","tag-csrf-detection","tag-malware","tag-scan-local-file-injections","tag-scan-malware","tag-scan-remote-file-inclusion","tag-scan-sql-injections","tag-scan-xss","tag-vulnerabilities-scan","tag-vulnerability-detection","tag-waf-detection","tag-web-application-security-scanner"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/8411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/comments?post=8411"}],"version-history":[{"count":11,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/8411\/revisions"}],"predecessor-version":[{"id":12088,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/posts\/8411\/revisions\/12088"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/media\/8415"}],"wp:attachment":[{"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/media?parent=8411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/categories?post=8411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.esds.co.in\/blog\/wp-json\/wp\/v2\/tags?post=8411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}