SecurityTrails Blog

A recent study by IBM found that nearly six in ten responding organizations accelerated their digital transformation efforts due to the COVID-19 pandemic. The disruptive ground brought on by the global crisis, further exacerbated by the rise in hybrid and remote workforces, has shown organizations just how important it is to be built for change. They need to be both scalable and flexible, and the same goes for their IT infrastructures.

Cloud adoption and management is now at the top of priority lists for CISOs and executives, with the same study's organizations planning a 20% increase in their prioritization of cloud technology over the next two years. There is clearly no doubt that digital transformation and accelerated cloud adoption can help organizations optimize and streamline their operations, create innovative business offerings and achieve competitive advantage. However, the implication of rapid digital transformation, adoption of new technologies and the remote/hybrid workers sprawl means that CISOs and security teams can find themselves unable to fully grasp, and thus secure, an ever-growing attack surface.

The key role of attack surface management in digital transformation

Because of digital transformation, today's organizations don't keep all of their digital assets secured tightly behind their perimeter. Rather, they're scattered all over the Internet, sometimes forgotten and often unsecured. With more areas where a threat or cyber attack can take place, organizations need to protect their critical assets. Also because of digital transformation and cloud adoption, many organizations can suffer from issues with vendor migration and legacy tooling left online longer than planned. The best way to react and respond is with a full understanding of their external attack surface and all digital assets. This is why attack surface management plays a key role in the journey to a secure and successful digital transformation. Attack surface management, or ASM, allows organizations to identify, inventory, classify and monitor all digital assets in their external infrastructure.

For organizations with large amounts of cloud instances or hundreds of VPNs, AWS instances, etc., ASM can be particularly important, by helping them identify all of their attack surface components, attack vectors and exposures. With a unified view of its external infrastructure, an organization can better navigate across disparate technology systems and quickly map and resolve vulnerabilities while keeping pace with its dynamic attack surface. It can also arm the organization with insights toward making better-informed decisions regarding digital transformation efforts.

Solving digital transformation challenges with ASR

Attack Surface Reduction, ASR, is the platform we created to tackle the challenges of digital transformation and the dynamic attack surfaces that come with it. ASR can provide your organization with accurate insight into all digital assets, including their location, ownership and the services and technologies running on them. Essentially, ASR is there to make attack surface management easy.

Discover and visualize all of your digital assets

Many organizations struggle with keeping track of all their assets, but rushing to adopt new transformation technologies and diversify an IT environment can make staying on top of an already chaotic infrastructure even more challenging. The lack of visibility into its infrastructure can give an organization an incomplete picture of its digital risks, putting it at serious danger of a data breach. Asset discovery helps organizations maintain awareness over all of the assets and services running within their infrastructure. With continuous discovery, you can even find risks in forgotten and assets in development, well before they become threats. ASR allows you to visualize and organize all digital assets instantly, providing all information related to your apex domain, subdomains, associated domains, ...

In 2021, reports show that global M&A volumes topped $5 trillion. It makes sense: organizations pursue mergers and acquisitions in order to stimulate growth, gain competitive advantage, increase market share through gaining or consolidating personnel, technology and intellectual property.

As part of their due diligence, a critical component of any mergers and acquisitions process, organizations assess potential business impacts and risks of the merger or acquisition, in financial, legal and regulatory areas. And while cybersecurity due diligence preceding an mergers and acquisitions process often comes as an afterthought, the consequences of lax security assessment can lead to increased risk of data breach, failure to comply with regulations, financial and reputational losses.

Importance of pre mergers and acquisitions security assessment

While the importance of cybersecurity in mergers and acquisitions processes is widely recognized, innumerable high-level data breaches surrounding mergers and acquisitions are making it very clear that cybersecurity is frequently overlooked. Cybercriminals find the environment surrounding mergers and acquisitions alluring due to the number of companies and individuals involved, meaning that the potential for human error is heightened. Additionally, combining the cyber risk of two different companies increases the risk for both, and can lead to oversights resulting in failure to comply with regulatory requirements.

The main areas for pre mergers and acquisitions security assessment include:

Determining the target's compliance to support regulatory due diligence. The amount of digital assets and data they possess. How those assets are protected. The target's potential attack surface and the nature of vulnerabilities it may have.

While the discovery of cyber threats and even actual data breaches can harm an merger and acquisition deal, they don't often lead to outright termination. More commonly, they cause delays and add costs, usually due to compliance violations. Yet that can affect the entire outcome of the deal, including the value the acquirer places on the target company. To avoid these consequences, diligence during the pre mergers and acquisitions process is crucial. But this in itself presents a few challenges. The current state of pre mergers and acquisitions security assessments involves a lack of repeatable ways to measure internet-facing assets, incomplete asset lists and no information regarding services running on assets that potentially hold risks or vulnerabilities, or are out of policy.

Near-real-time pre mergers and acquisitions security assessment

In order to appropriately address the main areas for cybersecurity due diligence preceding an merger and acquisition deal, near-real-time assessment of assets and risks is necessary. A thorough understanding of assets can aid in guiding decisions as to which assets can be safely inherited and which technologies should be sunsetted in acquired companies. Furthermore, near-real-time inventory and assessment of risks of all assets further informs efforts toward regulation or policy compliance and the monitoring of vulnerable services. Instantly uncovering the entire external infrastructure of a subsidiary, pinpointing potential risks, and having actionable data on total assets, assets with services that need to be sunsetted, and assets that are out of policy is easy, all with Attack Surface Reduction (ASR).

ASR can aid in pre mergers and acquisitions security assessment with:

Asset discovery

Depending on the size of the acquired company, mergers and acquisitions can be a messy process. This is especially true when it comes to asset discovery and understanding where assets are located, asset ownership and the services or technologies running on them. With our automated asset analysis, ASR provides you with access to a centralized view into all discovered external infrastructure assets via the Inventory section, including information...

Cyber threats in the modern IT landscape can lead to severe fallout, including compromised data, damage to brand reputation, and loss of customers and revenue. In order to effectively minimize risk, many organizations rely on automated security solutions and software that provide real-time risk analysis and produce alerts whenever an anomaly is detected.

These alerts are crucial. They provide security teams with the knowledge of peculiarities necessary to indicate when malicious attackers attempt to breach their network and get their hands on an organization's sensitive data. However, false alerts can and do happen, and over time, this leads to security teams becoming desensitized to them.

Dangers of alert fatigue in Sock teams

In a security operations center, alerts that originate from innumerable amounts of systems and tools compete to get the attention of security analysts, who battle to defend their organization from cybersecurity threats as effectively as possible. Putting the numbers in perspective, organizations with over 1,000 employees utilize around 70 security products from more than 30 different vendors. And all of those products produce alerts that can cause alert fatigue in Sock teams. Alert fatigue in cybersecurity, also known as operational fatigue, occurs when Sock analysts become desentized to alerts from their tools because of their frequency. It's a major challenge faced by Sock teams as they bear the immense responsibility of maintaining network and data system security. Even the simplest of negligence, caused by alert fatigue, can compromise an entire organization's infrastructure.

The fallout from IT alert fatigue in Sock teams can manifest in several ways:

Burnout that can lead to a high-stress environment and high turnover of analysts.

Lack of financial return to the organization.

Security incidents and data breaches being missed by the Sock team.

Empowering Sock teams with ASR

Sock teams waste valuable time manually correlating high volume alert data from multiple security tools. These alerts lack prioritization and actionable context, leaving the team to do all the heavy lifting, potentially spending time on low-risk alerts while missing out on critical ones. For Sock analysts to respond to questions of incident relevance quickly and combat alert fatigue, having a ready understanding of public-facing internet assets is critical. Access to alert fatigue solutions that provide contextual data is also vital, for Sock analysts to better comprehend the magnitude of an alert and its accompanying threat to a digital asset in their organization's infrastructure. Attack Surface Reduction, (ASR) provides your Sock teams with appropriate asset context to effectively prioritize risks and incidents across your entire cloud and on-prem infrastructure. ASR benefits include:

Near real-time inventory of all external-facing assets - ASR's Inventory section gives your team a unified view of all discovered infrastructure data, keeping them informed on potential security issues such as IP's pointing local, remote access points with open ports, exposed VPN endpoints and more.

Highlighting of critical exposures on assets - Along with its inventory of all discovered assets, our proprietary automated asset analysis reveals critical security risks such as open database ports, self-signed certificates that can indicate service misconfiguration, and staging and development subdomains that are often left unprotected.

Appropriate contextual asset data - To effectively prioritize risks and incidents across your entire cloud and on-prem infrastructure, ASR's Explorer tab allows your team to choose an asset for which they need more context and simply scroll down to uncover relevant data such as open ports, ASN information, redirects and more.

Proactivity with actionable data - To make the right call on securing critical assets, the Activity tab lets you keep an eye on all new assets automatically discovered by ASR, allowing for p...

After 2020, a year of unprecedented change and revelation, and with the whole world facing a multitude of challenges, we entered 2021 colored in a fresh layer of optimism, confidence and defiance.

Security trails has taken in this sense of resilience and purposefulness generated by the perilous nature of 2021. We're celebrating this year's innumerable gains in providing our customers with proprietary solutions to secure their IT infrastructure and mitigate cyber risk. Some of our biggest product releases and updates, partnerships, integrations, acquisitions of some of the best infosec tools available, community-led and -focused efforts and campaigns, exciting executive hires and even sharp Security trails swag marked 2021 as a bright new horizon for our company. So as we edge closer to 2022, let's take a moment to look back on 2021 and our achievements throughout those 365 days.

Transforming our talented, remote Security trails team

Our vision, mission and culture have crystallized throughout 2021, further influencing the Security trails team, but our singular passion for remaining The Total Internet Inventory has remained intact. We've bolstered our executive team with new hires as well as long-time colleagues growing into new positions, shaping our team to help us achieve this goal. While there weren't that many of our beloved retreats, collaboration remains at the heart of our remote team. We've continued to connect and collaborate through internal projects, courses, our Lunch & Learn series and monthly virtual get-togethers. In Q4 our Leadership team had a meeting in Orlando, Florida where a new roadmap for 2022 was brought to life. We're excited to show you how it all unfolds! If you're interested in empowering organizations toward thwarting cyber attacks with up-to-date data, custom solutions and proprietary tools, come join our diverse and talented team of experts!

Head over to our Careers page to learn more about Security trails culture and open positions in our departments.

Product launches and updates

One of the things we're most proud of in 2021 is the immense amount of work we put into releasing new products and solutions, enhancing our existing tools, and continuously bringing incremental improvements to our pipeline. And it was all thanks to the feedback provided by you, our users and customers. You can check all our product updates and launches on our blog, as well as in our Changelog. With regular improvements, releases and fixes, possibly too many to count, let's highlight 2021's major Security trails launches and updates:

Attack Surface Reduction

Starting the year with a real bang, we released a new version of our powerful Attack Surface Reduction solution. ASR is your one-stop shop for exploring the entire internet surface area of your organization, gaining full visibility over your digital assets and IT infrastructure, giving you a way to take decisive action to reduce risks and prevent attacks.

Notable feature updates include:

Design changes that provide easy prioritization of information, with more effective aesthetics to enrich any report that calls for your attack surface data. The Screenshots option, to further improve visualization of digital assets. An expanded Explorer tab, to provide even more detailed information about your organization's digital assets and deeper attack surface data analysis. Technology detection that allows all our ASR customers access to important backend technology data into any tech running on remote hosts. WAF detection, which allows security researchers and any organization performing discovery and software identification to determine whether assets do or do not have WAF protection.

Security trails SQL

Right in the middle of 2021, after many weeks of developing, testing and perfecting, we finally saw the general release of our SQL-like query language: Security trails SQL. This new product allows security researchers and teams to perform massive intelligence collection an...

We are excited to announce that we are beginning the implementation of single sign-on (SSO) access across Securitytrails. Okta SSO is the first provider we’re bringing on in this effort to deliver secure authentication and a better user experience to our users.

SSO and its security benefits

Single sign-on (SSO) is an authentication service offered by various providers that allows for the use of only one set of credentials, usually a username and password, to access multiple applications securely. With the emergence of cloud computing and the accelerated use of software-as-a-service (SaaS), organizations are adopting the centralized authentication of SSO as an efficient way to provide risk-free access to multiple resources. Some of the main security benefits organizations have reported with the implementation of SSO are:

Decrease in likelihood of password theft: One of the best security practices is to have strong and unique passwords for each account/app, but that can be difficult to manage on an organizational level. With SSO, users only need one strong passphrase, meaning they're more likely to remember it and less likely to store it carelessly. Prevention of shadow IT: Shadow IT is becoming more prevalent in cloud-centric environments. SSO allows for monitoring which apps are used by and permitted for users, thus preventing further shadow IT. Help with regulatory compliance: Common regulations such as HIPAA require effective authentication of users as well as automatic logoff for all accessed resources, which SSO effectively enables.

Our choice: Okta SSO

Okta was our first choice, as it's one of the as an SSO provider best for enterprise users. Known for its numerous integrations, Okta SSO provides different directory types and powerful and essential features that allows for easy implementation and a user-friendly interface. Okta is standard-compliant with the O-Auth 2.0 protocol that controls authorization of access to sensitive resources and is a certified OpenID Connect provider, a protocol built on the OAuth 2.0 that provides user authentication and SSO functionality.

How to enable SSO in Securitytrails

To enable SSO authentication in your account, simply contact us requesting to change your default authentication scheme (please note that as a requirement you’ll need to previously setup an application inside your Okta organization and provide its client_id along with your designated Okta login’s domain name). For a detailed procedure on how to set it up, please check our SSO documentation. After SSO is enabled on your account, you'll receive an email containing an invite link to begin the authentication process. The link in the email will then redirect you to a confirmation page to continue. After confirmation, you'll be presented with a login prompt, where you'll need to sign in with your SSO credentials to be authenticated. Once you enter your credentials, user authentication takes place against the chosen SSO provider—currently with Okta SSO. You're all set!

For future SSO authentication usage you can validate your account by using a login link that's unique to your organization, which will be in the following format:

This is just the start

Implementing Okta is the first step in enabling SSO across Securitytrails and providing centralized authentication to our users. More authentication protocols will be rolled out in the future—stay tuned!

We are excited to announce that we are beginning the implementation of single sign-on (SSO) access across Securitytrails. Okta SSO is the first provider we’re bringing on in this effort to deliver secure authentication and a better user experience to our users.

SSO and its security benefits

Single sign-on (SSO) is an authentication service offered by various providers that allows for the use of only one set of credentials, usually a username and password, to access multiple applications securely. With the emergence of cloud computing and the accelerated use of software-as-a-service (SaaS), organizations are adopting the centralized authentication of SSO as an efficient way to provide risk-free access to multiple resources. Some of the main security benefits organizations have reported with the implementation of SSO are:

Decrease in likelihood of password theft: Surely one of the best security practices is to have strong and unique passwords for each account/app, but that can be hard to enforce on an organizational level. With SSO, users only need one strong passphrase, meaning they're more likely to remember it and less likely to store it carelessly. Prevention of shadow IT: Shadow IT is becoming more prevalent in cloud-centric environments. SSO allows for monitoring which apps are used by and permitted for users, thus preventing further shadow IT. Help with regulatory compliance: Common regulations such as HIPAA require effective authentication of users as well as automatic logoff for all accessed resources, which SSO effectively enables.

Our choice: Okta SSO

Okta was our first choice, as it's one of the best SSO providers available for enterprise users. Known for its numerous integrations, Okta SSO provides different directory types and powerful and essential features that allows for easy implementation and a user-friendly interface. Okta is standard-compliant with the O-Auth 2.0 protocol that controls authorization of access to sensitive resources and is a certified OpenID Connect provider, a protocol built on the OAuth 2.0 that provides user authentication and SSO functionality.

How to enable SSO in Securitytrails

To enable SSO authentication in your account, simply contact us requesting to change your default authentication scheme (please note that as a requirement you’ll need to previously setup an application inside your Okta organization and provide its client_id along with your designated Okta login’s domain name). For a detailed procedure on how to set it up, please check our SSO documentation. After SSO is enabled on your account, you'll receive an email containing an invite link to begin the authentication process. The link in the email will then redirect you to a confirmation page to continue. After confirmation, you'll be presented with a login prompt, where you'll need to sign in with your SSO credentials to be authenticated. Once you enter your credentials, user authentication takes place against the chosen SSO provider—currently with Okta SSO. You're all set!

For future SSO authentication usage you can validate your account by using a login link that's unique to your organization, which will be in the following format:

This is just the start

Implementing Okta is merely the first step in enabling SSO across Securitytrails and providing centralized authentication to our users. More authentication protocols will be rolled out in the future—stay tuned!

Humans, in most cases, are not built to process and conceptualize data in any significant measure or speed.

Notwithstanding, the last several years have seen an unprecedented growth in data collection and ingestion techniques driven by newer forms of network and cloud technologies, arousing a particular (and ever-growing) concern among the cybersecurity community as diminished visibility threatens to grow proportionally to the degree of integration. In other words, organizations should be asking themselves if the logs and data they're collecting are actually telling the whole story and, if they are, is the human component, namely the incident responders and threat hunters at the crossroads, able to quickly align itself with what really took place. There is, however, a new tool on the horizon that threatens to disrupt the old paradigm of looking endlessly at relational entities, such as spreadsheets, in search of the mythical "Aha!" moment. Gigasheet.

Combining the succinct dimensionality of structured data with a powerful analytics engine capable of handling billions of data points at a time, Gigasheet will certainly innovate the prescriptive space where data can be manipulated, aggregated, queried, and analyzed under a single web-based ecosystem that is as broadly intuitive as it is powerful. Incidentally, given this project's characteristics and the demands currently placed on good data quality, we could think of no better tool than our very own SQL Explorer to generate large recon activity that could be easily consumed and analyzed, a collaborative endeavor that surely did not disappoint.

Enter Gigasheet

The future belongs to big data; there's very little doubt about that. The terminology, in all its rich diversity, dominates just about every aspect of our digital lives, including niche (e.g., non-tech) environments that once exhibited a smattering of it, with the cyber security industry being a definitive, representative sample of the ongoing trend. For instance, in cyber, data flows in from a multitude of services often in disparate formats and lattices underscored by the originating application. As the pipeline grows, analysts can be easily caught in a never-ending cat-and-mouse game of chasing after interesting artifacts and traffic, especially if their toolset of choice lacks important filtering, joining, and intersecting capabilities, for the latter, large data dumps can dramatically compound on the problem by requiring significant processing times even when pitted against robust hardware specifications.

When the early adoption of cloud-based analytic tools became the dominant narrative, many seized the opportunity to integrate the emerging technology into their processes. This, however, entailed aggregating and normalizing, slicing and dicing, and similar operations, just to arrive at a suitable model capable of interoperability. Thus, when presented with these and similar challenges, many chose (and still do) to resort to off-the-shelf applications (think Microsoft Excel here) for quick data representation, others preferred more programmatic approaches, such as the acclaimed Pandas library, but these precluded many entry-level professionals from expeditiously manipulating the data due to a substantial learning curve. To break down some of these important barriers, Gigasheet's team realized that accelerating analysis meant removing the initial scaffolding, reducing the setup effort to a small number of clicks.

This is SaaS at its best, conducting resource-intensive tasks with ease and scalability without worrying about the underlying infrastructure, reliability, and accessibility for all team members who no longer need to be sidetracked by maintenance windows or hardware issues, resulting in increased collaboration, as well as overall faster response times to critical items in need of immediate attention. Best of all, Gigasheet's 24 by 7 development cycle directly translates to optimizations and fixes that are rol...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Databases are among the most important parts of a web application. Almost every action performed on your web application involves using a database in some form to determine what to perform next, to store a user's input, or to give a user information. These three user interactions form the most essential functions that a web application performs.

Databases often contain tons of valuable information, including usernames, passwords, email, IDs, addresses, phone numbers, and much more. This treasure trove, however, also makes the database one of the most targeted parts of a web application. Looking at some of the largest database breaches in history further emphasizes just how valuable the information stored within your organization's database can be. And database hacks are not always sophisticated hacks that occur due to software code faults. Frequently, the simple yet fatal misconfiguration of a database's operation is the root cause of data breaches.

Hello Elasticsearch

Some of the most common database hacks include the use of Elasticsearch, a popular database that is highly efficient at storing large amounts of data as well as analyzing and visualizing the data it stores. This makes it super popular within organizations that have a lot of logging or other large data to be analyzed. Elasticsearch by default binds to localhost only, which is secure enough, but to make Elasticsearch usable in an organization, database administrators often make the mistake of binding Elasticsearch to the public network interface without firewalling it. While this may seem normal at first, keep in mind that Elasticsearch has no default user authentication setup on it. Manual configuration is required to enable the xpack module which then allows one to set up a password based authentication on Elasticsearch. The above misconfiguration allows attackers to simply enter, delete data, steal data, and exit.

Again, there is simply no way to determine whether a user is a hacker or not. This simple flaw has caused a countless number of hacks within Elasticsearch over the years and continues to do so even today.

Security breaches caused due to database compromises can lead to loss of data as well. At times, data is not only stolen but also destroyed by attackers. Read more about data loss prevention here. Now, let's take a closer look at how to identify open and exposed databases.

Consequences of a database breach

The consequences of a database breach are extensive and often seen as a critical cause of trust issues in any web application. Because databases often contain sensitive information like first and last names, home addresses, personal phone numbers, and other information that is shared in confidence, leaks of such data are perceived as negative and highly harmful, leading to trust issues and customer departures from compromised web applications. Another facet of database breaches is the threat of silent attacks. These involve attackers making minor changes to a database in order to gather or steal data over a long period of time and also to compromise targeted accounts. This was often seen in cryptocurrency exchanges in the past, wherein user accounts would get compromised and funds stolen, as well is as in advanced persistent threats (APT).

With newer laws coming into place such as the GDPR (in Europe), ICO (in the UK) and various other regional laws, dealing with breaches can also involve legal consequences and financial fines. These laws require companies operating within those regions to report breaches within 24 hours or less. Failure to do so can incur larger fines and other legal consequences. However, beyond laws, legal consequences, and financial losses, your reputation is the most important aspect of your web application. It is essentially what drives users to your platform, makes them stay, and prompts them to recommend it ...

Today we're excited to announce several improvements in our Whois historical records that take our data to the next level, so you can analyze any domain name ownership information more efficiently.

Enhanced Whois timeline

Our improved Whois timeline will now detect business 'Start Date'. This feature will show the exact date when new companies and individual owners acquire active domain names. At the exact moment of acquisition of the domain, the domain history changes in our database, and you’ll be able to visualize the new records easily on the public Whois timeline. As you can see in the screenshot above, you'll see the ownership change of a domain name in history. Additionally, it will be possible to detect public and private Whois records thanks to our red-and-blue color scheme.

Additional Whois historical records

Along with the timeline changes, we're also introducing additional Whois historical records to our database. This will let you obtain even more information than before, as shown in this comparison:

This new enhancement goes deeper into the history of a domain name and allows you to extract additional data from its records. This helps security analysts find noteworthy spots to examine while uncovering the full historical behaviour of a company's asset.

To go even deeper into the domain history analysis, you simply need to scroll left on the timeline to find older records that may seem interesting until the desired timeline position is found. As an example, the above analyzed domain name has several dates to be checked against. Once clicked, the Whois information corresponding to that exact date will be displayed below. With additional historical information, you can easily visualize the life of domain names, their owners, contact information, and much more.

Summary

These new enhancements to our Whois data will allow you to gain more visibility over changes throughout the Whois timeline, while providing access to historical records spanning further into the past, not previously available in our database. Whether you're using our Security trails API or any of our other products such as Surface browser, the new Whois data is already available for you.

If you don't have an account with us yet, grab your Prototyper API key to start querying Whois data today!

Today we are happy to introduce the new Explorer Tab for ASR. This new version redefines the concept of asset exploration, providing even more detailed information about any of your digital assets, to help you perform attack surface data analysis in a much better way.

Look for the new 'Explorer' tab

Take a look at all the new and exciting capabilities included within this upgraded version of our ASR Explorer. This release contains several improvements, including:

Better visual web app identification with the use of home page screenshots. Extended infrastructure detection capabilities such as Waf detection and Backend Technology mapping, and more! If this summary is as exciting for you as it is for us, please join us in the following sections where we briefly showcase each of the most interesting new features ready for you to test!

Technology Detection

This new version includes access to Technology detection, particularly important concerning backend technologies running on the remote host, along with their versions. This new analysis feature helps you build a technology profile, showing you what websites are built with, such as CMS, application servers, frameworks, e-commerce platforms, Javascript libraries, and much more, as you can see from the above screenshot.

Screenshots

In a separate tab, to the right of the host list, you'll find a 'Screenshots' option. This new feature allows you to visualize screenshots of all assets in an extensive way, as shown here:

Additionally, it's also possible to see the different screenshots by looking at the Explorer tab’s main dashboard and hovering over the listed open ports highlighted with a white sheet. Once that's done, a screenshot snippet will appear next to the position of your pointer, which will provide you with a home page visual preview.

Waf Detection

Waf Detection helps security researchers during the application discovery and software identification phase and serves well to keep an eye on how many of your assets do or do not have any Waf to protect them.

Which Waf's can be detected?

ASR can detect almost any kind of Waf, and just to mention some of the more popular ones, they include: Cloudfront, Cloudflare, AWS Elastic Load Balancer, Cache Wall, Incapsula, Kona Site Defender, DOS arrest, Zenedge, Big-IP Local Traffic Manager, Net Scaler App Firewall, Wordfence, and many other commercial and generic Waf's.

Summary

With these new features in ASR Explorer, organizations can gain even more visibility over the status of their digital assets in a quick and centralized manner, covering previous asset data from our original 'Explorer' version while adding new and critical information about server technologies and software versions, as well as useful crawling details.

Take advantage of this bold new infosec feature, get a clear picture of all your assets and begin securing your IT infrastructure as quickly as possible, request access to ASR today.