Apparently 8/10 High Traffic or ‘Big’ Websites are Vulnerable

Use Netsparker


It seems after a brief scan that about 80% of sites contain common flaws that allows them to be compromised in some way, most often to create phishing sites, steal data and hijack info about clients.

An amazing 30% contain a serious vulnerability.

Eight out of ten Web sites contain common flaws that can allow attackers to steal customer data, create phishing exploits, or craft a variety of other attacks, a security company reported today.

WhiteHat Security regularly scans hundreds of “very popular, very high-traffic sites” for its online business customers, says Jeremiah Grossman, the company’s founder. “More than likely, you have shopped there, or bank there,” he says. Thirty percent of scanned sites contain an urgent vulnerability, such as one that allows direct access to a company database with customer information, he says.

Two out of three scanned sites have one or more cross-site scripting (XSS) flaws, which take advantage of problems with sites’ programming and are increasingly used in phishing attacks. A recent eBay scam used a now-fixed XSS hole on the auction site to direct anyone who clicked on a phony car auction to a phishing site.

I guess this should be a stern lesson for anyone shopping online or using online facilities from any companies/banks or financial institutions.

About a third of scanned sites are at risk for some sort of information leakage, which often means the providing of programming data about the site that can facilitate an attack. And about one out of four sites allows content spoofing, another potential phishing risk, according to WhiteHat’s vulnerability report.

A type of database vulnerability that allows SQL injection attacks — “one of the nastier issues out there” — is becoming less common, Grossman says. Fewer than one out of five sites contain this type of vulnerability, but a successful incident can give a sophisticated attacker access to everything in a company’s database, he says.

The irony is those geeky sites which hold the least important information about people are usually the most secure, where as the big sites built by important companies often have the most vulnerabilities and are leaking the most important data.

Source: Computer World

Posted in: Exploits/Vulnerabilities, Web Hacking

, ,


Latest Posts:


BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.


5 Responses to Apparently 8/10 High Traffic or ‘Big’ Websites are Vulnerable

  1. Bogwitch July 6, 2007 at 5:32 pm #

    It comes as no suprise that a Whitehat Security is reporting such high figure – it is in their interest to.

    “About a third of scanned sites are at risk for some sort of information leakage, which often means the providing of programming data about the site that can facilitate an attack.” – Isn’t that condoning security through obscurity??

    Fewer than one in five of the high traffic websites are vulnerable to SQL injection attacks? That’s still an incredibly high rate.

    Bogwitch.

  2. CK76 July 6, 2007 at 6:30 pm #

    Most information on the internet isn’t secure. SUPRISE!

  3. gyaresu July 7, 2007 at 4:40 am #

    Yeah. It’s like credit card companies paying millions in compensation for scams because the system is essentially flawed and scams still only account for a minor portion of total transactions.
    Where is the incentive to secure your site? I never seem to hear of any repercussions when thousands users data is ‘lost’/stolen etc.

    Just look at the American FBI for how not to spend a stupid amount of money on a computer system.

    There’s really no accountability for high security practices and even then vulnerabilities will always exist.

    It’d be funny if it didn’t potentially effect me.

    /me crosses fingers to avoid identity theft.

  4. Patrick Ogenstad July 7, 2007 at 9:40 am #

    It reminds me of the time when we had all those directory traversal issues in IIS. I once took a phone directory and went through the alphabet for companies offering computer services. Of the companies running IIS more than 80% were vulnerable, of course those were other times. :)

  5. SN July 9, 2007 at 8:01 pm #

    no way … that much traffic.