topic Re: Executing Web Scanner on Splunk WebUI in Security

Executing Web Scanner on Splunk WebUI- What issues should I be on the lookout for?

chaday00 — Fri, 29 Jul 2022 17:09:45 GMT

One of my ISSO's asked that I scan an implementation of the Splunk WebUI using Burp Suite Enterprise (similar to a Nessus Web App scan or WebInspect scan).

What issues should I be on the look out from doing this?
- Mitigations?
Any known settings / best practices for this?
In terms of user agreements, are there any known clauses that might limit/prevent this?

Thank you

Re: Executing Web Scanner on Splunk WebUI

_joe — Fri, 29 Jul 2022 16:30:30 GMT

I don't have a whole lot of information about this, just wanted to comment that personally I've had an issue with Burp Suite crashing Splunk.

We have had to ask them to turn back the Burp Suite threads to half.

Re: Executing Web Scanner on Splunk WebUI- What issues should I be on the lookout for?

PickleRick — Fri, 29 Jul 2022 17:42:40 GMT

Well, automatic scanners can produce lots of false positives. Especially if operated by inexperienced crew and/or not screened manually afterwards.

There was a thread lately about a scanner finding "SQL injection" among other things in Splunk.