Full Scan Capabilities
Scans the websites inside and outside Huawei Cloud, supports intranet scanning, intelligently associates assets, and identifies asset fingerprint information.
Ease of Use
VSS performs network-wide scanning with just a single click. Custom scan jobs and classified asset management facilitate risk management and simplify O&M.
Efficiency and Accuracy
With the Web 2.0 Crawler technology and an optimized internal verification mechanism, VSS improves the detection accuracy and fast scanning on critical CVE vulnerabilities.
The vulnerability assessment report aggregates security data and clearly presents asset risks from multiple angles.
Website Vulnerability Scan
Website vulnerabilities can lead to crippling impact on business and cause financial loss if not found and addressed at the earliest possible time.
Incorporates a vulnerability rule library for scanning all types of websites and produces comprehensive scan reports.
Security experts analyze the latest critical vulnerabilities and update rules to provide the fastest and most complete CVE vulnerability scan.
Weak Password Scan
Passwords are usually used for remote login to assets such as hosts or middleware. Attackers often use scanning technologies to hack usernames and weak passwords.
Scans for standard web services, all OSs, and 90% of all middleware, including databases.
Simulates hacker detection of weak passwords. You can also use your own weak password library to detect passwords.
Middleware helps develop and integrate complex application software flexibly and efficiently. If a hacker discovers and exploits vulnerabilities in the middleware, the security of the upper layer and lower layer is compromised.
Supports vulnerability scanning of mainstream web containers, foreground development frameworks, and background microservice stacks, as well as configuration compliance scanning.
Chooses standard scan or custom scan to identify the middleware and its version in the server, and discover vulnerabilities and risks.
Non-compliant content on your site can stain your brand image and lead to financial losses.
Synchronously updates sample data from hot topics in politics and public opinion, and accurately identifies inappropriate and illicit content, including violence-related, terrorism-related, and politically sensitive information.
Performs semantic analysis on texts and images to identify complex texts.
Enables specialized vulnerability scanning of assets, including web applications, middleware, and weak passwords.
Monitors the latest network vulnerabilities 24x7, updates scan rules at the earliest possible time, and rapidly detects vulnerabilities in your assets.
SSH, RDP, SMB, MySQL, Microsoft SQL Server, MongoDB, Redis, Oracle, DB2, GaussDB, Postgres, and Telnet
Front-end vulnerabilitiesSQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and URL redirection
Port exposure, directory traversal, backup files, insecure files, insecure HTTP methods, and insecure ports
Web injectionsCommand injection, code injection, XPath injection, Server-Side Request Forgery (SSRF), and deserialization vulnerabilities
- File inclusion
Reading, inclusion, and upload of any file, and XML External Entity attack (XXE attack)
Critical vulnerability detection
Monitors the latest high-risk vulnerabilities and your important assets, locates the affected servers or websites once a high-risk vulnerability is discovered, and provides detailed recommendations for resolving potential security issues.
Intelligent scan speed control
The scan engine adjusts the scan speed based on site load, ensuring service continuity. Harmless scanning prevents dirty data from being written into your databases.
Identifies inappropriate and illicit content to protect your brand image.
In compliance with Huawei and CIS benchmarks, checks for weaknesses in security configurations to expose vulnerabilities.
Quickly and accurately detects non-compliant content using deep learning technologies and a large set of sample libraries.
Stability and reliability
Stays up to date on any breaking news and quickly updates the detection library. VSS has been tested and used over the years across a variety of complex scenarios.
OS baseline, Nginx, Apache, Tomcat, Docker, and more
Account security check
Checks whether the password complexity and password policy of server accounts meet profile requirements.
Check for compliance with benchmarks
Checks whether baselines comply with Huawei and CIS benchmarks.
Database risk detection
Checks high-risk configurations of databases such as MySQL and MongoDB.
Generates a comprehensive scan report with detected vulnerabilities classified and provides the recommended actions to improve site defenses.
Customizes scan parameters based on your needs.
Professional scan reports
Provides detailed information, including URLs, vulnerability names, and descriptions, that can be downloaded to a local PC.
Classifies vulnerabilities by severity and provides recommendations on how to fix each type.
Customization of login methods
Chooses the method best suited for you to log in, such as using the account and password or cookies.
Custom scan plugins
Selects specific plugins so you can scan specific types of vulnerabilities and quickly identify risks.
Sets the crawler user agent (UA) and excludes links from being crawled, enhancing scan security.
Customizes the start time of a scan, helping you avoid performance bottlenecks during peak service hours; creates periodic scan jobs based on your needs.
Website vulnerability scan launched for OBT
Weak password scan and high-risk port detection
One-click authentication for tenants on HUAWEI CLOUD
Scan for a critical CVE vulnerability
Available on HUAWEI CLOUD International
Host vulnerability scan and baseline compliance check
Web content moderation
Apache Struts 2 RCE vulnerability scanning
Scan for security vulnerabilities related to Ecshop
Asset detection and management