SecAlerts
Security and privacy
vulnerability alerts
SHOW HN2019
How HN took it
1 positive, 7 neutral or asking, 1 mixed, 13 critical, out of 22 comments about the project. Thread score -0.50.
Execution: 1 for, 6 againstPrivacy: 0 for, 3 againstPerformance: 0 for, 2 againstIdea: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Detected stack and a critical CVE for coop.co.uk
From 1 comment
The first URL I entered (coop.co.uk) was actually pretty awesome, it detected Varnish and showed a critical CVE from last week. That’s cool. I hope that if you subscribe, the…
paulfurley on HN
Objections
Publishing a site's stack makes it easier to attack
From 4 comments
i don't need to provide my (potentially vulnerable) production URL to whoever-you-might-be in order to identify the last 6 months of vulnerabilities - I can just google for that.…
meesterdude on HNThis is the textbook definition of security by obscurity.
adtac on HNPart of securing your stack is not sharing with everyone exactly what you have, or do you not study security at all?
not_a_cop75 on HNThis is a nice addendum to the "Let Us Identify Your Stack" style web services tho I guess some of them might already provide this. It does have the somewhat negative effect of…
mellosouls on HN
Privacy concern about collecting IPs and stack data
From 2 comments
Finally, a place that can gather IP addresses and associate them to specific security products to have them hacked later. Just what I've been waiting for.
not_a_cop75 on HNIt's not you, but the implicit idea of trust. How are three people I know nothing about going to give me better results than a known name? Best of luck establishing yourselves…
not_a_cop75 on HN
Detection is inaccurate (Apache, Ruby on Rails misidentified)
From 2 comments
My static site running on OpenBSD 6.5 httpd gets identified as Apache ¯\_(ツ)_/¯
wilsonthewhale on HNMy Angular site is getting detected as Ruby on Rails :)
KrishnaAnaril on HN
Fails to detect many servers such as lighttpd
From 2 comments
I pointed it at my lighttpd server and all I got was "cannot detect software" or so.
swiley on HNWasn’t able to detect what software my site use, my server name was disabled.
jamessteel on HN
API overloaded and returning errors
From 1 comment
Looks like it's overloaded - HTTP/502 on the API here.
r1ch on HN
Requests
Detect by library or framework, not platform
From 1 comment
It’s a pretty poor implementation that is basically matching on the lowest common denominator, by platform rather than by library or framework. An ASP.NET website is fully…
ComputerGuru on HN
Crawl subdirectories to find multiple technologies
From 1 comment
It’s a pretty poor implementation that is basically matching on the lowest common denominator, by platform rather than by library or framework. An ASP.NET website is fully…
ComputerGuru on HN
Periodic rescanning and alerts
From 2 comments
The first URL I entered (coop.co.uk) was actually pretty awesome, it detected Varnish and showed a critical CVE from last week. That’s cool. I hope that if you subscribe, the…
paulfurley on HNIs there an open source alternative that could be self-hosted and configured to run automated and periodical checks?
mrlucax on HN
Open source release
From 1 comment
Is this released open-source ?
fnigi on HN
Questions
Is it open source?
From 1 comment
Is this released open-source ?
fnigi on HN
Is there a self-hosted open source alternative?
From 1 comment
Is there an open source alternative that could be self-hosted and configured to run automated and periodical checks?
mrlucax on HN
Alternatives named
Wappalyzer and browser extensions
From 2 comments
There are browser extensions that do this same thing. It's pretty trivial to do.
dahfizz on HNhttps://www.whatruns.com/ not so precise must say
oriettaxx on HN
Shodan
From 1 comment
Wait until you hear about shodan...
yjftsjthsd-h on HN
OWASP ZAP, Nikto, Metasploit
From 3 comments
While not a web or automated option - if you want to run a quick crawl and scan on your apps you could try OWASP ZAP, it also has quite a few handy plugins -…
smcleod on HNMetasploit isn't the best choice for webapps, you probably want nikto or similar. Here's the owasp list: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools
Godel_unicode on HNMetasploit? You don't even need to host it (why are we so obsessed with making everything a website?)
dahfizz on HN
masscan
From 1 comment
In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan
nighthawk454 on HN