Re: vulnerability scanners not effective? or just a false-positive?

["Joel Jose" <joeljose420 () 1net gr>]

well yeah, agreed its a vuln not a threat. My mistake, actally i just spelt
it wrong, a twist of toungue?.. i always considered it as a vuln not a
threat. nyways thanks for pointing.

well in my tests, only 2 subdomains, suffered from this vuln, others had
been protected from directory traversal. So may be it was an overlook, or it
could have been done by different admins. I have informed them of the
situation.

I acknowledge that security through obscurity is just counterproductive, but
what i was meaning is that : The banner is not a thing which is "required"
to be open. We are not obscuring anything by removing the banner. Its just a
safe practise. Should we be lazy, to overlook it we might be exposing
ourselves to a pinch more of chances. Obscurity in my definition becomes
dangerous when we rely on it for protection. We arent trying to protect
anything here, by not displaying the banner. As someone rightly pointed out,
there are other parameters that an experienced person can always resort to
for service detections. By removing the banner we are just trying to comply
with safe practises, and may be "narrow" down our attacker to a competent
one.

joel.



------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
As attacks through web applications continue to rise, you need to proactively 
protect your applications from hackers. Cenzic has the most comprehensive 
solutions to meet your application security penetration testing and 
vulnerability management needs. You have an option to go with a managed 
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). 
Download FREE whitepaper on how a managed service can help you: 
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com
------------------------------------------------------------------------------