Security audit

Posted on 2011-10-26
Last Modified: 2013-12-06
I have done an audit to our IT infrastructure (windows 2008, exchenge, sql Server, Citrix, cisco routers/switches, hp printers, hp servers with insight manager, vmware, BB BES)
They have detected diferent vulnerabilities:
- Null sessions active: It allow to get all usernames and passwords
- Updates patch not update
- Vulnerability on vmware vcenter. They can manage the console without username
- SNMP default communities (servers, switches, ...)
- Access to BB BES without username/password
- Mcaffee OPE no nell configured
- It can be possible to identify SQL Server 2005 version

Could you recomend me a free or not free utility or precedure that allow me to check my it infraestructure periodically to discover vulnerabilities just to work on them.

Best regards
Question by:soporteorbit
    LVL 3

    Expert Comment


    Please use Nessus security scanner. This is PCI compliance. And freeware. (Free version is only one time 25 ip's scan, but seperate full scan.)

    please register home user and give serial number. (or 1200 $ professional)
    LVL 60

    Expert Comment

    It will be a life cycle of document review, system verification and validation to have a more complete security assessment. Focus on critical services first. The link has a good summary of the procedure and tools relevant to sieve out as many gaps and esp low hanging fruits. Importantly, hardenkng guide from vendor is essential for health check too, CIS, STIG and NIST has many guidance, if interested.
    LVL 25

    Expert Comment

    Look at Nessus; NeXpose; Qualys Guard; Retina Network Security Scanner; Saintbox; Shadow Security Scanner; Automated Scanning; FS 1000; Internet Scanner; LANguard

    look @

    1.      Nikto (Linux)
    2.      Paros proxy (Linux if you can)
    3.      Ike-scan (Linux)
    4.      SARA (Security Auditor's Research Assistant) (Linux)
    5.      MBSA (discutable)
    6.      AppScan from IBM

    Also look at

    Commercial Tools:
    Acunetix WVS by Acunetix
    AppScan by IBM
    Burp Suite Professional by PortSwigger
    Hailstorm by Cenzic
    N-Stalker by N-Stalker
    Nessus by Tenable Network Security
    NetSparker by Mavituna Security
    NeXpose by Rapid7
    NTOSpider by NTObjectives
    ParosPro by MileSCAN Technologies
    Retina Web Security Scanner by eEye Digital Security
    WebApp360 by nCircle
    WebInspect by HP
    WebKing by Parasoft
    Websecurify by GNUCITIZEN

    Software-as-a-Service Providers:
    AppScan OnDemand by IBM
    ClickToSecure by Cenzic
    QualysGuard Web Application Scanning by Qualys
    Sentinel by WhiteHat
    Veracode Web Application Security by Veracode
    VUPEN Web Application Security Scanner by VUPEN Security
    WebInspect by HP
    WebScanService by Elanize KG

    Free / Open Source Tools:
    Arachni by Tasos Laskos
    Grabber by Romain Gaucher
    Grendel-Scan by David Byrne and Eric Duprey
    Paros by Chinotec
    Zed Attack Proxy
    Powerfuzzer by Marcin Kozlowski
    SecurityQA Toolbar by iSEC Partners
    Skipfish by Michal Zalewski
    W3AF by Andres Riancho
    Wapiti by Nicolas Surribas
    Watcher by Casaba Security
    WATOBO by siberas
    Websecurify by GNUCITIZEN
    Zero Day Scan
    LVL 10

    Accepted Solution

    @gorhon: Nessus is not freeware for a business. Only for educational or personal use.

    @soporteorbit: Follow the list provided by madunix.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
    Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now