Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to know when scanning using NESSUS, though it is said its non-intrusive by default But what I want to know is how the use / definition or the testing conditions mentioned in the plugin-id effect the outcome of the scan. Does these conditions or tests or checks make the scan more intrusive in some way. I.e sending crafted packets. For e.g When the plugin-id checks for default password does this change its definition of scanning/ enumerating ports alone.

I have a recent example, where the gmond service 8649 was crashed as a results of scanning. It came to knowledge, that the service / port received non service traffic / data as a result its cpu consumption went to 100%. So, if its just non-intrusive port scanner how it resulted into crashing the service of remote host? It certainly is able to generate packets/ data as well.

Actually, is it fair to say that nessus uses NMAP scans / ports scanning results for services, and version of different application to give verdict on its vulnerable state or it make use of plugin-id and others information to conclude, give confidence marks on how vulnerable the particular service may be? (More checks > same results-> higher degree of confidence).

I appreciate if someone can help me understand what actually goes inside nessus core logic when it comes to make judgements / call on such matters. (vulnerable vs not vulnerable)

share|improve this question
    
I am not sure what you are asking. Are you asking how Nessus scans, or about what scans may be intrusive? –  GdD May 9 at 15:18
    
Asking if plugin properties makes scan intrusive from being just a tcp scanner. –  Saladin May 9 at 19:43

1 Answer 1

Nessus isn't a tcp scanner. Nmap is a scanner which finds open ports, Nessus is a vulnerability assessment tool which first uses a scanner to find open tcp and udp ports then then performs tests on the services found. Some of the tests it can do are intrusive and should only be chosen by looking at the risks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.