NESSUS NETWORK AUDITING

By MIA LEWIS

CONTENTS CHAPTER 1 VULNERABILITY ASSESSMENT INTRODUCTION WHAT IS A VULNERABILITY ASSESSMENT? WHY A VULNERABILITY ASSESSMENT? ASSESSMENT TYPES HOST ASSESSMENTS NETWORK ASSESSMENTS AUTOMATED ASSESSMENTS STAND-ALONE VS SUBSCRIPTION THE ASSESSMENT PROCESS DETECTING LIVE SYSTEMS IDENTIFYING LIVE SYSTEMS ENUMERATING SERVICES IDENTIFYING SERVICES IDENTIFYING APPLICATIONS IDENTIFYING VULNERABILITIES REPORTING VULNERABILITIES TWO APPROACHES ADMINISTRATIVE APPROACH THE OUTSIDER APPROACH THE HYBRID APPROACH REALISTIC EXPECTATIONS SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 INTRODUCING NESSUS WHAT IS IT? THE DE FACTO STANDARD HISTORY BASIC COMPONENTS CLIENT AND SERVER THE PLUGINS THE KNOWLEDGE BASE CHAPTER 3 INSTALLING NESSUS NESSUS VERSION COMPARISON PICKING A SERVER SUPPORTED OPERATING SYSTEMS MINIMAL HARDWARE SPECI? CATIONS NETWORK LOCATION NESSUS 2 2 X INSTALL GUIDE NESSUS INSTALL SCRIPT INSTALLATION FROM SOURCE /CON? GURE NESSUS 3 INSTALL GUIDE MAC OS X INSTALL PROCESS UNIX INSTALL PROCESS FRESH INSTALLATION RED HAT AND SUSE DEBIAN SOLARIS FREEBSD UPGRADING FROM NESSUS 2 CON? GURING NESSUS FOR UNIX CREATING A USER ACCOUNT WINDOWS INSTALL PROCESS FINAL STEPS INSTALLING A CLIENT CHAPTER 4 RUNNING YOUR FIRST SCAN PREPARING FOR YOUR FIRST SCAN AUTHORIZATION RISK VS BENE? T DENIAL OF SERVICE MISSING INFORMATION PROVIDING AUTHENTICATION INFORMATION PLUGIN SELECTION CONTENTS STARTING THE NESSUS CLIENT POLICIES POLICY TAB OPTIONS TAB CREDENTIALS TAB PLUGIN SELECTION TAB NETWORK TAB ADVANCED TAB TARGET SELECTION STARTING THE SCAN NESSUS COMMAND LINE CHAPTER 5 INTERPRETING RESULTS THE NESSUS UI BASICS VIEWING RESULTS USING THE NESSUS 3 CLIENT FOR LINUX/UNIX AND WINDOWS USING THE BASIC REPORT VIEWER SAVING AND EXPORTING TO OTHER FORMATS LOADING AND IMPORTING REPORTS READING A NESSUS REPORT UNDERSTANDING VULNERABILITIES UNDERSTANDING RISK UNDERSTANDING SCANNER LOGIC KEY REPORT ELEMENTS ASKING THE RIGHT QUESTIONS FACTORS THAT CAN AFFECT SCANNER OUTPUT THE ROLE OF DEPENDENCIES SAFE CHECKS NO404 NASL PING THE REMOTE HOST PORTSCANNER SETTINGS PROXIES, FIREWALLS, AND TCP WRAPPERS VALID CREDENTIALS KB REUSE AND DIFFERENTIAL SCANNING AND MANY MORE… SCANNING WEB SERVERS AND WEB SITES CONTENTS WEB SERVERS AND LOAD BALANCING BUGS IN THE PLUGINS ADDITIONAL READING CON? GURATION FILES NASL THE NESSUS KB THE NESSUS LOGS FORUMS AND MAILING LISTS CHAPTER 6 VULNERABILITY TYPES CRITICAL VULNERABILITIES BUFFER OVER? OWS DIRECTORY TRAVERSAL FORMAT STRING ATTACKS DEFAULT PASSWORDS MISCON? GURATIONS KNOWN BACKDOORS INFORMATION LEAKS MEMORY DISCLOSURE NETWORK INFORMATION VERSION INFORMATION PATH DISCLOSURE USER ENUMERATION BEST PRACTICES CHAPTER 7 FALSE POSITIVES WHAT ARE FALSE POSITIVES? A WORKING DE? NITION OF FALSE POSITIVES WHY FALSE POSITIVES MATTER FALSE POSITIVES WASTE YOUR TIME FALSE POSITIVES WASTE OTHERS’ TIME FALSE POSITIVES COST CREDIBILITY CONTENTS GENERIC APPROACHES TO TESTING AN OVERVIEW OF INTRUSIVE SCANNING AN OVERVIEW OF NONINTRUSIVE SCANNING THE NESSUS APPROACH TO TESTING DEALING WITH FALSE POSITIVES DEALING WITH NOISE ANALYZING THE REPORT FALSE POSITIVES, AND YOUR PART IN THEIR DOWNFALL DEALING WITH A FALSE POSITIVE DISABLING A NESSUS PLUGIN DISABLING A PLUGIN WITH NESSUS 3 DISABLING A PLUGIN UNDER UNIX MARKING A RESULT AS A FALSE POSITIVE WITH NESSUSWX FALSE POSITIVES AND WEB SERVERS—DEALING WITH FRIENDLY 404S CHAPTER 8 UNDER THE HOOD NESSUS ARCHITECTURE AND DESIGN HOST DETECTION SERVICE DETECTION INFORMATION GATHERING VULNERABILITY FINGERPRINTING DENIAL-OF-SERVICE TESTING PUTTING IT ALL TOGETHER CHAPTER 9 THE NESSUS KNOWLEDGE BASE KNOWLEDGE BASE BASICS WHAT IS THE KNOWLEDGE BASE? A WORD ABOUT THE “POLICY XML” ? LE WHERE THE KNOWLEDGE BASE IS STORED USING THE KNOWLEDGE BASE INFORMATION EXCHANGE HOW PLUGINS USE THE KNOWLEDGE BASE TO SHARE DATA THE TYPE OF DATA THAT IS STORED DEPENDENCY TREES CONTENTS CONTENTS LIMITATIONS USING GET_KB_ITEM AND FORK CHAPTER 10 ENTERPRISE SCANNING PLANNING A DEPLOYMENT DE? NE YOUR NEEDS PLANNING PREPARATION SEGMENTATION NETWORK TOPOLOGY BANDWIDTH REQUIREMENTS PORTSCANNING PHASE TESTING PHASE AUTOMATING THE PROCEDURE CON? GURING SCANNERS ASSIGNING THE TASKS SYSTEM REQUIREMENTS SCANNING FOR A SPECI? C THREAT DIVIDE AND CONQUER SEGREGATE AND LIMIT CERTI? CATES FOR THE FORGETFUL SPEED IS NOT YOUR ENEMY KEEP A WATCHFUL EYE DATA CORRELATION COMBINING REPORTS PREPARING YOUR DATABASE DIFFERENTIAL REPORTING FILTERING REPORTS THIRD-PARTY TOOLS EXTRACTING INFORMATION FROM A SAVED SESSION PRIOR TO VERSION 2 2 0 OF NESSUSD USING SD2NBE NESSUS INTEGRATION WITH PERL AND NET::NESSUS::SCANLITE PRIOR TO VERSION 3 0 0 NESSUS NBE REPORT PARSING USING PARSE::NESSUS::NBE COMMON PROBLEMS AGGRESSIVE SCANNING CONTENTS VOLATILE APPLICATIONS PRINTER PROBLEMS SCANNING WORKSTATIONS CHAPTER 11 NASL WHY NASL? WHY DO YOU WANT TO WRITE (AND PUBLISH) YOUR OWN NASL SCRIPTS? STRUCTURE OF A NASL SCRIPT THE DESCRIPTION SECTION AN INTRODUCTION TO THE NASL LANGUAGE WRITING YOUR FIRST SCRIPT ASSUMING THAT THE FTP SERVER IS LISTENING ON PORT 21 ESTABLISHING A CONNECTION TO THE PORT DIRECTLY RESPECTING THE FTP PROTOCOL WRAPPING IT UP MORE ADVANCED SCRIPTING STRING MANIPULATION HOW STRINGS ARE DE? NED IN NASL STRING ADDITION AND SUBTRACTION STRING SEARCH AND REPLACE REGULAR EXPRESSIONS IN NASL THE NASL PROTOCOL APIS HTTP FTP NFS OTHER PROTOCOL API LIBRARIES THE NESSUS KNOWLEDGE BASE CHAPTER 12 THE NESSUS USER COMMUNITY THE NESSUS MAILING LISTS SUBSCRIBING TO A MAILING LIST SENDING A MESSAGE TO A MAILING LIST ACCESSING A LIST’S ARCHIVES CONTENTS THE ONLINE PLUG-IN DATABASE STAYING ABREAST OF NEW PLUG-INS REPORTING BUGS VIA BUGZILLA QUERYING EXISTING BUG REPORTS CREATING AND LOGGING IN TO A BUGZILLA ACCOUNT SUBMITTING A BUG REPORT SUBMITTING PATCHES AND PLUG-INS SUBMITTING PATCHES SUBMITTING PLUG-INS WHERE TO GET MORE INFORMATION AND HELP CHAPTER 13 COMPLIANCE MONITORING WITH NESSUS 3 UNDERSTANDING COMPLIANCE HIPAA PAYMENT CARD INDUSTRY (PCI) FERPA NERC ISO/IEC 27002:2005 NIST 800 SERIES THE NESSUS COMPLIANCE ENGINE COMPLIANCE WITH NESSUS TYPES OF AUDITS AUDIT FILES HOW AUDIT FILES WORK EXAMPLES USING NESSUS 3 AUDITING UPDATING NESSUS 3 PLUGINS CREATING A NEW POLICY STARTING YOUR AUDIT NESSUS 3 REPORTING