{"id":10813,"date":"2007-08-29T12:19:24","date_gmt":"2007-08-29T09:19:24","guid":{"rendered":"https:\/\/mamchenkov.net\/wordpress\/2007\/08\/29\/chorizo-security-scanner\/"},"modified":"2007-08-29T12:19:24","modified_gmt":"2007-08-29T09:19:24","slug":"chorizo-security-scanner","status":"publish","type":"post","link":"https:\/\/mamchenkov.net\/wordpress\/2007\/08\/29\/chorizo-security-scanner\/","title":{"rendered":"Chorizo security scanner"},"content":{"rendered":"\n

(Originally I wanted to tweet this, but it grew far longer than 140 characters.)<\/em><\/p>\n

I tried a free version of Chorizo security scanner<\/a>. It’s one of those tools that should make secure web applications much easier.<\/p>\n

I liked the idea of the proxy setup.\u00c2\u00a0 Instead of downloading any software or scanning a web site generating lots of extra traffic, it works in a proxy mode.\u00c2\u00a0 You configure a proxy server in your browser, add the domain to Chorizo profile, verify the domain by uploading a signature file to the server, and then simply browse around.\u00c2\u00a0 There are a couple of nice windows hanging around, showing you things, etc.\u00c2\u00a0 It even works in Konqueror…<\/p>\n

What I didn’t like that the scanner didn’t find any problems with an obviously problematic web site.\u00c2\u00a0 I can easily do SQL injections on the pages that I browsed and I am sure cross-site scripting isn’t any more difficult.\u00c2\u00a0 Yet, the scanner showed “0 vulnerabilities found” message.<\/p>\n

There is also a commercial offering of the service, where you can add more than one domain and have some advanced reports and stuff.\u00c2\u00a0 But, I don’t feel like paying a couple of hundred EUR per year for something that didn’t find obvious problems.<\/p>\n

Maybe they are a new service or have some temporary problems. Maybe I’ll give them another try some time later.\u00c2\u00a0 But for now the answer is\u00c2\u00a0 a definite “No”.\u00c2\u00a0 Pity.<\/p>\n\n","protected":false},"excerpt":{"rendered":"\n

(Originally I wanted to tweet this, but it grew far longer than 140 characters.) I tried a free version of Chorizo security scanner. It’s one of those tools that should make secure web applications much easier. I liked the idea of the proxy setup.\u00c2\u00a0 Instead of downloading any software or scanning a web site generating … Continue reading Chorizo security scanner<\/span><\/a><\/p>\n\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[1],"tags":[],"keyring_services":[],"class_list":["post-10813","post","type-post","status-publish","format-standard","hentry","category-general"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t