Re: vulnerability scanners not effective? or just a false-positive?



Hi,

have been able to access them as a piece of cake. Ofcourse the network is
safe as long as the attacker doesnt "learn" the name of the important
directories. But i think it is a very "huge" vulnerability. and nessus didnt
even give a hinch!!

Nessus, like many vulnerability scanners is a blacklist. These scanners search for "known vulnerabilities". You cannot expect them to know of all vulnerabilities in a timely fashion. Furthermore, how did you configure the scanner? Was it set to crawl the website or did you tell it how the website was structured? Did you tell it to try all exploits or just try from what it thinks the OS/app is? While Nessus is a really good scanner, there is also an element of human interaction that is needed for it to work optimally for you.


and one more quest. How many of you think that the existance of the default
banners in services(eg apache default error pages) are a security threat, if
not high, atleast medium?. I do.

First, they wouldn't be the threat, they would be the vulnerability if you're talking Risk. Second, you do mean existence of correct and exact banners, don't you? While the less Visibility and information you provide, the better, there is sometimes a business need or an established balance between having an Exposure (aka Information Leak) and the cost of fixing it in a timely manner, most often before a service is put in a hostile environment. Finally, I can agree with neither your high, medium, or low mean nothing to other people. My wife likes her shower really hot. But that's hot to me. She thinks it's normal (her medium). Risk is relative to the organization not to you. In the OSSTMM 3.0, banners are often an Exposure if they are true, which is a level 4 calculation (1st being a vulnerability) and is defined as simply that which provides information on a Visibility. If banners are false or misleading on purpose to hide information on the service and other measures are taken to truly disguise the operational work behind the service, they are calculated under the Privacy loss control for that Access point from that vector.

I know, I over-answered. Sorry. Ya'll can wake up now.

Sincerely,
-pete.

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request@xxxxxxxxxx
------------------------------------------------------------------------------



Relevant Pages

  • nessus gtk yields empty scan
    ... nessus-libnasl-2.2.9_1 Nessus Attack Scripting Language ... The discovery may be accidental or through directed research; the vulnerability, in various levels of detail, is then released to the security community. ... the plug-ins should be updated. ... The native Unix GUI version is installed at server install time. ...
    (freebsd-hackers)
  • Re: Cross testing exploit with vulnerability scan results
    ... I have been using Nessus since years now.. ... scanner that might be temporary ... ... remember that vulnerability scanning with an automated scanner is ... else you may download 'bad code'. ...
    (Pen-Test)
  • nessus scan - epmap (135/tcp)
    ... As somebody has already pointed out, the version of Nessus is a little ... Nessus (as well as other true vulnerability ... passive vuln scanner for this), but that they do not actively exploit the ... Security Trends Report from Cenzic ...
    (Pen-Test)
  • Vuln Scan vs. Pen Test -- WAS: Re: Penetration testing books
    ... but does cover Nessus very well. ... A vulnerability scan is NOT a penetration test! ... "Pen Test Report" on the client's door step along with their invoice. ... even the most lamely deployed firewall will filter the majority of the ...
    (Security-Basics)
  • Re: What is being a pen tester really like?
    ... Nessus is a vulnerability scanner and using it to ... conduct a test is called a vulnerability assessment. ... Security experts recommend that an annual penetration test be ... This is NOT something Nessus does, ...
    (Pen-Test)