Re:Rate my Startup: Golem Technologies Web Security
by swalberg on Thursday February 17, 2011 @09:42AM
(#2231043)
Just to follow up on myself, I installed skipfish and ran it against my site in the easiest mode (./skipfish -W /dev/null -LV -o rpt http://example.com)
* I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry.
* Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.
* I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry.
* Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.