What Your Web Vulnerability Scanners Aren't Telling You

What Your Web Vulnerability Scanners Aren't Telling You

Explore the limitations of automated web vulnerability scanners in this 41-minute conference talk from Louisville Infosec 2014. Delve into common vulnerabilities often overlooked by scanners, including logic flaws, insecure authentication practices, and access control issues. Learn about weak password policies, user enumeration, lack of account lockout, and password reset flaws. Discover defense strategies against account harvesting and insecure CAPTCHA implementations. Examine client-side concerns and the dangers of assuming web obscurity. Gain valuable insights and takeaways to enhance your web security practices beyond automated scanning.