Aggregating asset vulnerabilities
In a system for determining vulnerabilities associated with a web property, requests are communicated to network accessible servers associated with a set of one or more domains. Software components indicated in responses from the network accessible servers are identified. Vulnerability information is obtained for the software components. An aggregate vulnerability is determined for each network accessible server based on at least one of a ratio of software components of the network accessible server indicated as vulnerable by the vulnerability information to total software components used by the network accessible server and a frequency of use of those of the plurality of software components of the network accessible server indicated as vulnerable by the vulnerability information. Vulnerability of the network accessible servers is indicated based on the aggregate vulnerabilities.
1. A method comprising:
communicating first requests to network accessible servers associated with a set of one or
more domains;
identifying a plurality of software components indicated in responses from the network
accessible servers;
obtaining vulnerability information for the plurality of software components;
determining an aggregate vulnerability for each network accessible server based on at
least one of a ratio of software components of the network accessible server indicated as vulnerable by the vulnerability information to total software components used by the network accessible server and a frequency of use of those of the plurality of software components of the network accessible server indicated as vulnerable by the vulnerability information; and
indicating vulnerability of the network accessible servers based on the aggregate vulnerabilities.
2. The method of claim 1 , further comprising identifying the network accessible servers associated with the set of domains.
3. The method of claim 2 , wherein identifying the network accessible servers comprises communicating second requests to network addresses associated with the set of one or more domains to identify the network accessible servers.
4. The method of claim 1 , wherein communicating the first requests comprises communicating to each of the network accessible servers multiple requests, each of which corresponds to a different user agent.
5. The method of claim 1 , wherein the network accessible servers comprise web servers.
6. The method of claim 1 , wherein identifying the plurality of software components comprises determining identifiers and versions of the plurality of software components.
7. The method of claim 6 , wherein obtaining the vulnerability information for the plurality of software components comprises querying a set of one or more databases with the identifiers and versions of the plurality of software components.
8. The method of claim 1 , wherein determining frequency of use of those of the software components of the network accessible server indicated as vulnerable comprises determining frequency of use across the network accessible servers.
9. The method of claim 1 , wherein the first requests comprise hypertext transfer protocol requests.
10. The method of claim 1 , wherein identifying the plurality of software components comprises determining names of the plurality of software components.
11. The method of claim 10 , wherein obtaining the vulnerability information for the plurality of software components comprises querying a set of one or more databases with the names of the plurality of software components.
12. A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
communicating first requests to network accessible servers associated with a set of one or
more domains;
identifying a plurality of software components indicated in responses from the network
accessible servers;
obtaining vulnerability information for the plurality of software components;
determining an aggregate vulnerability for each network accessible server based on at
least one of a ratio of software components of the network accessible server indicated as vulnerable by the vulnerability information to total software components of the network accessible server and frequency of use of those of the plurality of software components of the network accessible server indicated as vulnerable by the vulnerability information; and
indicating vulnerability of the network accessible servers based on the aggregate vulnerabilities.
13. The non-transitory, computer-readable medium of claim 12 , further having instructions executable by a computing device to perform operations comprising identifying the network accessible servers associated with the set of domains.
14. The non-transitory, computer-readable medium of claim 12 , wherein communicating the first requests comprises communicating to each of the network accessible servers multiple requests, each of which corresponds to a different user agent.
15. The non-transitory, computer-readable medium of claim 12 , wherein identifying the plurality of software components comprises determining identifiers and versions of the plurality of software components.
16. The non-transitory, computer-readable medium of claim 15 , wherein obtaining the vulnerability information for the plurality of software components comprises querying a set of one or more databases with the identifiers and versions of the plurality of software components.
17. The non-transitory, computer-readable medium of claim 12 , wherein obtaining the vulnerability information for the plurality of software components comprises querying a set of one or more databases with names of the plurality of software components.
18. An apparatus comprising:
a hardware processor; and
a physical storage medium having instructions stored therein, the instructions executable by the hardware processor to cause the apparatus to,
communicate via a set of one or more network interfaces first requests to network
accessible servers associated with a set of one or more domains;
identify a plurality of software components indicated in responses from the network
accessible servers;
obtain vulnerability information for the plurality of software components;
determine an aggregate vulnerability for each network accessible server based on at least
one of a ratio of software components of the network accessible server indicated as vulnerable by the vulnerability information to total software components of the network accessible server and frequency of use of those of the plurality of software components of the network accessible server indicated as vulnerable by the vulnerability information; and
indicate vulnerability of the network accessible servers based on the aggregate vulnerabilities.
19. The apparatus of claim 18 , wherein the instructions to identify the plurality of software components comprise instructions executable by the hardware processor to cause the apparatus to determine names of the plurality of software components.
20. The apparatus of claim 19 , wherein the instructions to identify the plurality of software components comprise instructions executable by the hardware processor to cause the apparatus to query a set of one or more databases with the names of the plurality of software components.