Re: Cross testing exploit with vulnerability scan results

Well, sadly, this is why you should not completely depend on vulnerability scanners to conduct a full penetration test - they don't catch everything you like, and sometimes they make false- negatives, as well as false-positives, and other times faulty code can impact your audit severely.

Regards,
John Martinelli
RedLevel.org Security

On Jul 27, 2007, at 8:25 AM, Chroot wrote:

Hi Fellow testers,

I've been conducting pen tests since 4 yrs now... the methodology I
follow is that we exploit or attempt to exploit ONLY those
vulnerabilities that a vulnerability scanner identifies. What if the
appropriate check or signature in the vulnerability scanner was not up
to date or had some coding issue or was not comprehensiveness enough
(or anything else) to identify a real existing vulnerability on a
system. This can result in serious false negatives. Would downloading,
installing and cross testing all available exploits for an identified
service be a good idea to minimize such a case? How many people have
faced such an issue or a similar issue? For me I faced this issue with
some bug in Nessus recently.

This is something like my NMAP says there is IIS6.0 running on port
443 of a target server. I do a Nessus scan on it and it doesn't report
anything. I then download all available exploits for IIS6.0 (or for
all version of IIS? would this make sense) from securityfocus.com or
securiteam.com or similar source and run it manually on the target
system.

Eagerly await opinions.

THNX

---------------------------------------------------------------------- --
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
---------------------------------------------------------------------- --



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • RE: Cross testing exploit with vulnerability scan results
    ... I believe you should always check and cross check your scans. ... remember that vulnerability scanning with an automated scanner is ... else you may download 'bad code'. ... vulnerability analysis - not a penetration test. ...
    (Pen-Test)
  • RE: Cross testing exploit with vulnerability scan results
    ... don't know how to USE nessus properly. ... remember that vulnerability scanning with an automated scanner is ... else you may download 'bad code'. ... vulnerability analysis - not a penetration test. ...
    (Pen-Test)
  • Re: Vulnerability scanner/appliance
    ... There are no PCI certified vulnerability scanners. ... that although certain vulnerability scanner vendors offer ASV services ... With that being said I have no doubt that the ASV services sold by ...
    (Security-Basics)
  • Re: [fw-wiz] concerning ~el8 / project mayhem
    ... >>think even vulnerability scanners are mostly a waste of time. ... > advocating good security design over testing? ... While I am indeed advocating good design, I'm not against validation, I'm ... seen a vulnerability scanner yet that would handle that well. ...
    (Firewall-Wizards)
  • [TOOL] SSH Secure Shell 3.0.0 Vulnerability Scanner
    ... SSH Secure Shell 3.0.0 Vulnerability Scanner ... For more information about this vulnerability, ... # (Options must come before host name) ...
    (Securiteam)