ASafaWeb

Automated Security Analyser For Websites

[ASafaWeb @ASafaWeb]

It's end of life for @ASafaWeb. Read more in the final blog post: https://t.co/v3EkfHQqnX

[ASafaWeb @ASafaWeb]

You can now test for disabled view state MAC using @ASafaWeb. Here's what it's all about and how to test for it: http://t.co/zgDWOBtCF6

[ASafaWeb @ASafaWeb]

@gschuermans awesome, lots more stuff coming too (as soon as I find time...)

[ASafaWeb @ASafaWeb]

@gschuermans sorry for the slow response, glad you got it sorted.

[ASafaWeb @ASafaWeb]

@martin_costello hi Martin, it's a good point and it's on the backlog, stay tuned!

[ASafaWeb @ASafaWeb]

ASafaWeb is now scanning for ELMAH logs in the /elmah route as well as looking for the default handler. Give it a go https://t.co/D8wc0sfwr7

[ASafaWeb @ASafaWeb]

ASafaWeb just completed it's 100,000th scan! About 2 in 3 sites scanned still have serious security misconfig issues http://t.co/Pg818pZbET

[ASafaWeb @ASafaWeb]

@j3rbrown you're trying not to return a 302? That seems like a separate issue to returning a yellow screen, are you able to share the URL?

[ASafaWeb @ASafaWeb]

@j3rbrown have a look at the URL in the scan report used to test this - do you see a yellow screen of death?

[Troy Hunt @troyhunt]

Blogged: Dynamic security misconfiguration scanning with @OnCheckinApp and @ASafaWeb http://t.co/MCoVMdR2iN

[ASafaWeb @ASafaWeb]

ASafaWeb now has a self-assessment "Scorecarding" feature to help locate publicly identifiable risks: http://t.co/ywEqytqUCJ

[ASafaWeb @ASafaWeb]

@SwissHttp that's, no good, fixed now, thanks!

[ASafaWeb @ASafaWeb]

Are you adding an XFO header to your website to protect against clickjacking? ASafaWeb now detects when it's missing: http://t.co/HTwC2amgtY

[ASafaWeb @ASafaWeb]

@MrKWatkins but you're not the one to ask and I am conscious that would be of use to people. Never say never!

[ASafaWeb @ASafaWeb]

@MrKWatkins not at this stage simply because it's a very different model. It moves from being a service to needing to be a distributable app

[ASafaWeb @ASafaWeb]

@MrKWatkins sorry Kevin, it's only available as an online service at this point in time.

[ASafaWeb @ASafaWeb]

@ProVega good point, I'll drop it into the "investigate further" list. Need to see if it's prevalent enough to warrant an extra request.

[ASafaWeb @ASafaWeb]

@SimonAntony huh, that's odd, maybe try a password reset. Hopefully the email gets through.

[ASafaWeb @ASafaWeb]

@SimonAntony you look trustworthy - I've just manually approved :) You should be able to login now.

[ASafaWeb @ASafaWeb]

@SimonAntony Hi Simon, mail logs say it went, not in your junk by any chance? If not then I'll manually activate for you.