Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which methods do you use to quickly scan a network for certain vulnerabilities?

I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but that it had to be done via the command line. But that was long ago, and Nessus is different now. Is this possible today, and if so, what's the correct syntax?

Is this also possible with OpenVAS? If it's not possible with either Nessus or OpenVAS in their current incarnations, would it be easier to write Nmap NSE scripts to find these vulnerabilities -- and what would be the trade-off in terms of functionality, reliability, and performance compared to Nessus/OpenVAS?

An example list of the types of vulnerabilities that I'm talking about can be found in the Pen Test Bookmarks, under the section "MSF Exploits or Easy". I'm trying to build and enhance my own version of common/easy exploits based on my own personal risk management and penetration-testing experience.

share|improve this question
    
Hey, I thought you said you didn't like automation. –  Rook Apr 11 '11 at 21:54
    
@Rook: Yes, I don't like automation. Just answer the question, please –  atdre Apr 11 '11 at 22:39
    
Here are the primary reasons I don't like automation and think it's more expensive (in terms of both time and money) -- en.wikipedia.org/wiki/… –  atdre Apr 11 '11 at 22:47
    
@atdre Oah i understand the confusion now. We are talking about entirely different types of tests here. Doing QuicktestPro/watir style tests does not find low hanging fruit. –  Rook Apr 11 '11 at 23:16
1  
@Rook: Google also believes that all applications are in permanent beta –  atdre Apr 12 '11 at 0:16

2 Answers 2

up vote 2 down vote accepted

Regarding nessus: ./bin/nasl works well, especially given the “-M” flag.

It’s pretty easy to modify existing nasl scripts or to copy and paste a single nasl script to derive a custom check.

The "-M" option is key because it enables script dependencies in cli mode. For example, the apache_http_version.nasl script has a dependency defined, which looks like:

$ grep dependencies ../lib/nessus/plugins/apache_http_version.nasl script_dependencies("http_version.nasl");

If you run a single nasl script that has dependencies without the "-M" flag, your results will be empty:

$ sudo ./nasl -t 10.10.10.5 ../lib/nessus/plugins/apache_http_version.nasl
$

But, if you add the "-M" flag, then you get the below (and a working check):

$ sudo ./nasl -M -V -t 10.10.10.5 ../lib/nessus/plugins/apache_ssl_overflow.nasl
----------[ Executing ping_host.nasl ]------
----------[ Finished ping_host.nasl ]------
----------[ Executing http_version.nasl ]------
----------[ Finished http_version.nasl ]------
[...]

share|improve this answer
    
Wow, incredibly useful. I found this -- blog.tenablesecurity.com/2007/06/using-the-nasl-.html -- but some of it might be outdated. I'm really looking for the state-of-the-art, perhaps a performance comparison –  atdre Apr 12 '11 at 1:52
1  
Also found -- blog.tenablesecurity.com/2010/11/… -- which answers a little better. Here you can seem to scan an entire directory full of NASLs (I just need to match them to my own personal lists) with the command -- bin/nasl -t 192.168.1.206 \ -k /opt/nessus/var/nessus/users/paulda/kbs/192/168/1/192.168.1.206 \ /opt/nessus/lib/nessus/plugins/account_*.nasl –  atdre Apr 12 '11 at 1:57
    
So NASL to launch NASL scripts and nessuscmd to run plugins? –  atdre Apr 12 '11 at 2:03
    
This looks cool, too, but probably wildly out-of-date -- michel.arboi.free.fr/nasl2ref –  atdre Apr 12 '11 at 2:30
    
I'm going to add this comment as well -- digininja.org/blog/nessus_over_sock4a_over_msf.php -- useful once you have a Meterpreter session –  atdre Apr 13 '11 at 19:33

Correct me if i'm wrong guys, but if i understand nessus correctly, each plugin reflects a specific vuln. If that's true, you could simply test only one plugin.

share|improve this answer
    
Your answer doesn't show the command line arguments and output, which is what I'm interested in. Please also avoid the speculation. –  atdre Apr 11 '11 at 21:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.