i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner so i have found the following result and for me to experience a lot about web apps i would like experiment on this website penetrate my site see if i can successfully run arbitary code send emails do stuffs inside my website.

Acunetix vulnerability results

A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file. Affected items

thank you


I have not used Acunetix before, since I do not rely on automated assessment tools personally. However, I would assume, that Acunetix does the service banner grabbing, identifies the version reported there, and then matches it against a know database of vulnerabilities without actually verifying if the exploit conditions are true. Since the latter is typically left to human pentester to execute and confirm.

If you Google for "nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12", you would find at least:

These might or might not have a publicly disclosed exploit code. Depending on that you would have to either do the patch analysis, debugging and exploit development on your own. Or if you are trying to secure your server -- then you would have to patch the software or implement the latest stable release.

For more hints and proof-of-concept exploits you can start your search with the exploit-db.com.

Hope this clarifies your question.

Not the answer you're looking for? Browse other questions tagged or ask your own question.