On-line web browser vulnerability tester

V

Virus Guy

Anyone want to comment on the technical accuracy / execution of this
website:

http://bcheck.scanit.be/bcheck/

I'm looking for 2 answers:

1) are the tests designed and executed correctly to simulate the browser
exploits being tested for?

2) what fraction of all possible (all known) drive-by exploits are
represented by these tests?

Is anyone in a position to test, say, an unpatched XP-SP1 or SP2
installation?
 
A

ASCII

Virus said:
Anyone want to comment on the technical accuracy / execution of this
website:

http://bcheck.scanit.be/bcheck/

I'm looking for 2 answers:

1) are the tests designed and executed correctly to simulate the browser
exploits being tested for?

2) what fraction of all possible (all known) drive-by exploits are
represented by these tests?

Is anyone in a position to test, say, an unpatched XP-SP1 or SP2
installation?

I have XP home SP2, isn't the Service Pack considered a patch?

I ran all the tests and no vulns were detected here.
 
V

Virus Guy

ASCII said:
I have XP home SP2, isn't the Service Pack considered a patch?

I ran all the tests and no vulns were detected here.

Is your system fully patched?

What I meant was, does anyone have a machine in a "virgin" XP-SP1 or SP2
state where some of these vulnerabilities are not patched.
 
D

Dustin Cook

ASCII said:
I have XP home SP2, isn't the Service Pack considered a patch?

A service pack contains ALL of the patches since SP1, plus whatever
enhancements available at the time it was published.

SP3 does the same, but has everything SP2 contained. I actually like the
service pack update way. You can take sp0 (as in, first gen) XP and
bring it fairly uptodate by running one huge ass exe file. Not bad. :)
 
D

Dustin Cook

Virus Guy said:
Anyone want to comment on the technical accuracy / execution of this
website:

http://bcheck.scanit.be/bcheck/

I'm looking for 2 answers:

1) are the tests designed and executed correctly to simulate the browser
exploits being tested for?

2) what fraction of all possible (all known) drive-by exploits are
represented by these tests?

Is anyone in a position to test, say, an unpatched XP-SP1 or SP2
installation?

I'm just curious, at what point will you do any of the research for your
questions on your own; and possibly share what you find? Instead of asking
people here and in other forums to do it all for you? You really won't
(obviously) learn much if others have to keep explaining things to you.
 
V

Virus Guy

Dustin said:
I'm just curious, at what point will you do any of the research for
your questions on your own;

If I was already a user of a system with virtualization capability it
would be easier for me to simulate platforms with known unpatched
vulnerabilities and hence I would have my answer. Since I don't have a
system with virtualization capability, I figured there would be no harm
in putting forward this question to this community.

Why are you taking my post so bluntly? What exactly do you have against
people asking questions on usenet? Is that a foreign concept for you?

Should I have not mentioned that site here?

Should I have not invited discussion as to the operational merits of the
facility being offered by that site?

Should I have not asked here if others can test the functional accuracy
of that site?
and possibly share what you find? Instead of asking people
here and in other forums to do it all for you?

What the hell kind of attitude is that?

Where do you get off that I want to sit back and let others do all the
work?

If you were to look back at my posts here, you'd see plenty of evidence
of what I investigate and post the results of. When there are things I
can't do (or do easily) why does it offend you if I ask if others might
be interested enough to try it?
You really won't (obviously) learn much if others have to
keep explaining things to you.

What you're saying is that nobody should ever ask a question, and nobody
should ever explain something to someone else. Not here, not in usenet,
maybe not even in a classroom. Because if they ask, then they'll never
learn. Just what is the nature of learning then?

So what should be posted to these newsgroups, if not questions?

What does that leave?

If you don't want to discuss that web-browser test site, then fine, you
didn't have to post a reply.

That you posted a reply that is just abusive says a lot about your
character.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top