NESSUS, SNORT, & ETHEREAL POWER TOOLS
CONTENTS PART I NESSUS TOOLS CHAPTER 1 THE INNER WORKINGS OF NASL (NESSUS ATTACK SCRIPTING LANGUAGE) INTRODUCTION WHAT IS NASL? THE DESCRIPTION SECTION THE TEST SECTION COMMONLY USED FUNCTIONS HOW STRINGS ARE DEFINED IN NASL STRING ADDITION AND SUBTRACTION STRING SEARCH AND REPLACE NESSUS DAEMON REQUIREMENTS TO LOAD A NASL FINAL TOUCHES CHAPTER 2 DEBUGGING NASLS HOW TO DEBUG NASLS USING THE RUNTIME ENVIRONMENT CHAPTER 3 EXTENSIONS AND CUSTOM TESTS EXTENDING NASL USING INCLUDE FILES EXTENDING THE CAPABILITIES OF TESTSUSING THE NESSUS KNOWLEDGE BASE EXTENDING THE CAPABILITIES OF TESTS USING PROCESS LAUNCHING AND RESULTS ANALYSIS CHAPTER 4 UNDERSTANDING THE EXTENDED CAPABILITIES OF THE NESSUS ENVIRONMENT WINDOWS TESTING FUNCTIONALITY PROVIDED BY THE SMB_NT INC INCLUDE FILE CHAPTER 5 ANALYZING GETFILEVERSION AND MYSQL PASSWORDLESS TEST INTEGRATING NTLM AUTHENTICATION INTO NESSUS’ HTTP AUTHENTICATION MECHANISM IMPROVING THE MYSQL TEST BY UTILIZING PACKET DUMPS IMPROVING NESSUS’ GETFILEVERSION FUNCTION BY CREATING A PE HEADER PARSER CHAPTER 6 AUTOMATING THE CREATION OF NASLS PLUGIN TEMPLATES: MAKING MANY FROM FEW SERVER-SIDE EXECUTION (SQL INJECTION, CODE INCLUSION) CLIENT-SIDE EXECUTION (CODE INJECTION, CROSS-SITE SCRIPTING, HTTP RESPONSE SPLITTING) PARAMETERIZE THE DETECTION AND TRIGGER STRINGS ALLOW DIFFERENT INSTALLATION DIRS ALLOW DIFFERENT HTTP METHODS MULTIPLE ATTACK VECTORS THE “WHY BOTHER” CHECKS AVOIDING THE PITFALLS USING A CGI MODULE FOR PLUGIN CREATION PERL’S CGI CLASS ADVANCED PLUGIN GENERATION: XML PARSING FOR PLUGIN CREATION XML AS A DATA HOLDER THE MSSECURE XML SCHEMA INS AND OUTS OF THE TEMPLATE GENERAL BULLETIN INFORMATION THE FINISHED TEMPLATE XML::SIMPLE TOOL USAGE THE SOURCE PART II SNORT TOOLS CHAPTER 7 THE INNER WORKINGS OF SNORT INITIALIZATION LIBPCAP PARSEPREPROCESSOR() PARSEOUTPUTPLUGIN() SNORT RULES EVENT QUEUE INITIALIZATION FINAL INITIALIZATION DECODING PREPROCESSING DETECTION CONTENT MATCHING THE STREAM4 PREPROCESSOR INLINE FUNCTIONALITY INLINE INITIALIZATION INLINE DETECTION CHAPTER 8 SNORT RULES WRITING BASIC RULES SID REV MSG REFERENCE CLASSTYPE PRIORITY CONTENT OFFSET DEPTH DISTANCE WITHIN NOCASE RAWBYTES URICONTENT ISDATAAT FLAGS FRAGOFFSET FRAGBITS IP_PROTO TTL TOS IPOPTS ACK SEQ DSIZE WINDOW ITYPE ICODE ICMP_ID ICMP_SEQ RPC SAMEIP RESP REACT LOGTO SESSION TAG WRITING ADVANCED RULES BYTE_TEST BYTE_JUMP FLOW FLOWBITS OPTIMIZING RULES TESTING RULES CHAPTER 9 PLUGINS AND PREPROCESSORS WRITING DETECTION PLUGINS WRITING PREPROCESSORS WRITING OUTPUT PLUGINS CHAPTER 10 MODIFYING SNORT SNORT-AV SNORT H SNORT C PARSER C SIGNATURE H DETECT C SNORT-WIRELESS ANTI-STUMBLER AUTH FLOOD DE-AUTH FLOOD MAC-SPOOF ROGUE-AP WIFI ADDR4 BSSID DURATION ID FRAGNUM FRAME CONTROL FROM DS MORE DATA MORE FRAGS ORDER POWER MANAGEMENT RETRY SEG NUMBER SSID STYPE TO DS TYPE WEP PART III ETHEREAL TOOLS CHAPTER 11 CAPTURE FILE FORMATS USING LIBPCAP USING TEXT2PCAP EXTENDING WIRETAP UNDERSTANDING CAPTURE FILE FORMATS FINDING PACKETS IN THE FILE THE MODULE_OPEN FUNCTION THE MODULE_READ FUNCTION THE MODULE_SEEK_READ FUNCTION THE MODULE_CLOSE FUNCTION BUILDING YOUR MODULE CHAPTER 12 PROTOCOL DISSECTORS SETTING UP A NEW DISSECTOR CALLING A DISSECTOR DIRECTLY USING A LOOKUP TABLE EXAMINING PACKET DATA AS A LAST RESORT NEW LINK LAYER PROTOCOL PROGRAMMING THE DISSECTOR ADVANCED DISSECTOR CONCEPTS CHAPTER 13 REPORTING FROM ETHEREAL IN THIS TOOLBOX WRITING LINE-MODE TAP MODULES TAP_RESET TAP_PACKET TAP_DRAW WRITING GUI TAP MODULES PROCESSING TETHEREAL’S OUTPUT XML/PDML