Top all-time · #3124
Invicti
Company blog · acunetix.com/blogsecurity
Invicti is the company blog at acunetix.com, writing about security. Since 2008, 25 different Hacker News readers have linked it 29 times, most often “TLS Security 6: Examples of TLS Vulnerabilities and Attacks”. It is still writing: the last post was on 2026-09-07, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link Acunetix blog articles as references on web security topics such as XSS, TLS and CRIME vulnerabilities, Host header attacks, long-password DoS and WordPress plugin SQL injection reports.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Invicti Web + API is an end-to-end web security scanner that offers a 360 view of an organization’s security. Allowing you to take control of the security of all you web applications, web services, and APIs to ensure long-term protection. Invicti Web + API’s scanning engine is globally known and tru
Most-linked posts?
- TLS Security 6: Examples of TLS Vulnerabilities and Attacks2 people · 2 mentions · first linked 2019-04-16
What Hacker News says?
http://www.acunetix.com/blog/web-security-zone/should-you-te... what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security pro…
Comment linking /blog/web-security-zone/should-you-test-development-staging-or-production/
on “Youth expelled from Montreal college after finding security flaw”Submitted HTTP Post Denial Of Service: More dangerous than initially thought as a story · 42 points
HN discussionSelf-maintaining code is a very rare thing. In general, if they were truly seeing no uptake on it, they could just be justified removing it to decrease their security surface ( https://www.acunetix.com/vulnerabilities/web/wordpress-plugi... ). I'd have to know which NGO and what their circumstances are to have a more concrete opinion. With no additional information, I can construct a hypothetical scenario where a re…
Comment linking /vulnerabilities/web/wordpress-plugin-rss-feed-reader-rss_url-parameter-cross-site-scripting-0-1/
on ““We removed the RSS feed since this technology became obsolete””Submitted Cookie Overdose as a story · 3 points
HN discussionIf anyone's curious this references the 8.3 filename shortening that windows was even still doing recently. Amusingly, that tiny bit of backward compatibility can lead to vulnerabilities as outlined here: https://www.acunetix.com/blog/articles/windows-short-8-3-fil...
Comment linking /blog/articles/windows-short-8-3-filenames-web-security-problem/
on “Processing 40TB of code from 10M projects with a dedicated server and Go”Submitted The email that hacks you as a story · 3 points
HN discussionGood question. Because it is an old protocol, vulnerabilities have been discovered in it over time [1]. Got to keep things updated! [1] https://www.acunetix.com/blog/articles/tls-vulnerabilities-a...
Comment linking /blog/articles/tls-vulnerabilities-attacks-final-part/
on “Tor Browser 10”Submitted Windows short (8.3) filenames – a security nightmare? as a story · 3 points
HN discussionI was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vector. https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-a...
Comment linking /vulnerabilities/web/crime-ssl-tls-attack/
on “Nginx quick reference”Submitted TLS Security 6: Examples of TLS Vulnerabilities and Attacks as a story · 2 points
HN discussionIf you don't do very much stuff, then sure. But most people end up coding long enough that learning new things is well worth the time. It's not like it takes more than a few months to learn a new framework or language, and you get benefits beyond just the new tools. Visual Basic is still a language that many people know better than other languages, but I'd not advise those people to stay on VB just because they know…
Comment linking /vulnerabilities/web/nginx-php-code-execution-via-fastcgi
on “Benchmarks of PHP 7.2 Beta: PHP Is Still Getting Faster”Submitted DOM XSS: An Explanation of DOM-Based Cross-Site Scripting as a story · 2 points
HN discussionhttp://news.ycombinator.com/item?id=5090007 A few days after reporting the flaw, he got caught using http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions. I still think it sucks that they expelled him. But I am unable to logically see how he di…
Comment linking /
on “Hamed Helped. Help Hamed.”Submitted 000webhost Breach Exposes 13M Passwords as a story · 2 points
HN discussionReflected XSS is still a big security problem. http://www.acunetix.com/blog/articles/non-persistent-xss/
Comment linking /blog/articles/non-persistent-xss/
on “Show HN: Security Training for Developers”Submitted Acunetix v13 Release Introduces Groundbreaking Innovations as a story · 1 points
HN discussionThis is not the first time that WP Fastest Cache has had a SQL injection vulnerability discovered. Here’s a report on 0.8.4.8: https://www.acunetix.com/vulnerabilities/web/wordpress-plugi... Here’s a report on 0.8.7.4: https://www.acunetix.com/vulnerabilities/web/wordpress-plugi... I could go on (all night) but I trust you all get the point. I have two questions. First, at what point can we say “Emre, you’re really…
Comment linking /vulnerabilities/web/wordpress-plugin-wp-fastest-cache-sql-injection-0-8-7-4/
on “Multiple vulnerabilities in WP Fastest Cache plugin”Submitted XML External Entity Vulnerability in Internet Explorer as a story · 1 points
HN discussionVulnerability scanners are usually premium (paid) products. Some offer free trials such as Qualys: https://www.qualys.com/forms/freescan/ Other famous tools are nessus, and accunetix: https://www.tenable.com/products/nessus-vulnerability-scanne... , http://www.acunetix.com/vulnerability-scanner/ These scanners are usually used by security consultants to test a complete internal network of a client. For a full list,…
Comment linking /vulnerability-scanner/
on “What I learned from suffering my first and last XSS attack”Submitted Directory Traversal Attacks as a story · 1 points
HN discussionHost header attacks aren't exactly new [0]. However it seems that this is deliberately vague to prevent people from exploiting it whilst systems are patched. I note that the CVE details [1] are not yet available, so perhaps the actual issue is a bit more complex. [0] https://www.acunetix.com/blog/articles/automated-detection-o... [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0787
Comment linking /blog/articles/automated-detection-of-host-header-attacks/
on “ASP.NET Core Elevation Of Privilege Vulnerability”Submitted Security Vulnerabilities Found in WP Super Cache and W3 Total Cache as a story · 1 points
HN discussion> there are two free (oss?) programs I'd recommend: Nessus and Snort Yeah sure, let me know how that goes for you... Nessus doesn't test websites and isn't open source (it's free for home use), and Snort isn't a vulnerability scanner! To the OP: If you want to test your website for security flaws, you can do the following (in no particular order): - Read the OWASP Top 10: http://www.owasp.org/index.php/Top_10_2007 -…
Comment linking /cross-site-scripting/Copy-scanner.htm
on “Ask YC: "Hacker-testing" service?”Submitted Using Acunetix Web Vulnerability Scanner as a Proxy Server as a story · 1 points
HN discussionThe web apps I've seen that do this all look pretty scammy. I wouldn't want them poking around my site. Then again, it is a public site, so... Anyhow, since there are several major attack vectors, there are also several different types of scanners. I recommend you read the book "breaking web software" to get a better understanding of the types of attacks. As far as tools, if you have a PHP install I recommend https:…
Comment linking /cross-site-scripting/scanner.htm
on “Ask HN: Is there any web apps that finds your site's security flaws”Submitted Acunetix WVS Version 6.5 build 20091215 released as a story · 1 points
HN discussionIt’s prudent to have some limit, to protect against long password DoS attacks ( https://www.acunetix.com/vulnerabilities/web/long-password-d... ). 63 is such a limit and long enough to allow users to pick secure passwords.
Comment linking /vulnerabilities/web/long-password-denial-of-service/
on “Ask HN: Why are the apple id passwords limited to a max amount of 63 chars?”I've read through the spec along with the FAQ that epeus so graciously shared here. The idea of mentioning beyond the scope of one website's walled garden seems like a very natural progression of ActivityPub and the new-found hype surrounding Mastodon. My concern is that I haven't seen much thought into the security implications. The spec makes it clear that they're trying to simplify pingbacks but they don't addres…
Comment linking /vulnerabilities/web/wordpress-pingback-scanner/
on “Webmention”
