1

I'm getting a "scan interference" finding (plugin 108714) in a PCI DSS scan, and I've proven there's no security products or firewalls or whatever interfering with my scan. I need to know what's happening before it runs the scan interference plugin to determine whether there's something that might possibly be interfering with my scan, so I've run the scan in Nessus, but it's extremely hard to determine where the plugin runs because it just looks like another SYN scan. Is there some way to figure it out?

4
  • I don't understand the need for a custom plug-in, as this question appears to be designed to introduce. Just run the one plug-in independently. What does a custom plugin get you?
    – schroeder
    Dec 9, 2022 at 8:13
  • Editing the plugin in this way gets you the ability to quickly search for where it does a particular thing in the pcap, which if you are debugging this plugin in particular can be quite large because an issue with it will most likely be related to another plugin that ran before, so you will have a long pcap from a long scan, and its packets are hard to search for because it's merely opening a connection. Did something crash the service before? Is it opening the socket weirdly? I had to do this recently; it took a lot of research and archaeology, so I am sharing it here for next time. Dec 10, 2022 at 9:27
  • Ok, I get that, but your proposed solution seems like using an elephant gun to kill a fly. Doesn't Nessus allow you to use a plug-in to send pings or custom packets?
    – schroeder
    Dec 10, 2022 at 11:35
  • Pings yes, for host availability; that adds to the KB and you can't choose when it runs. Sending custom packets, I don't believe so outside of writing a plugin. But again, this is for flagging a specific point of interest in NASL to debug issues with the way nessus is scanning by editing an existing plugin to add basically debug prints, and I used this to find a fairly serious nessus bug. Really not sure why this bothers you? Dec 10, 2022 at 15:44

1 Answer 1

2

Yes. Label the start of the plugin's run with the equivalent of a debug print.

On your own Nessus server, make a backup copy of the plugin, and then edit it.

This plugin is stored at /opt/lib/nessus/plugins/scan_interference.nasl, so copy that file somewhere else, and then just edit it.

Add some traffic to the file that's easy to filter on. I went right after the constant declarations (line 65 of this particular plugin) and added this:

icmp_label_outer = forge_ip_packet(ip_p:IPPROTO_ICMP, ip_src:compat::this_host());
icmp_label = forge_icmp_packet(ip:icmp_label_outer, icmp_type:250, icmp_code:111, icmp_seq: 1, icmp_id:1);
send_packet(icmp_label, pcap_active:FALSE);
send_packet(icmp_label, pcap_active:FALSE);
send_packet(icmp_label, pcap_active:FALSE);
send_packet(icmp_label, pcap_active:FALSE);
send_packet(icmp_label, pcap_active:FALSE);

In a nutshell, this tells the scanner to generate five valid ICMP packets with unassigned type 250. As this is incredibly unlikely to see naturally, you can reliably search in wireshark for icmp.type == 250 and get the timestamp where the plugin begins running.

To get the plugin code running, first disable plugin signatures temporarily (I'm not completely sure if this is needed or there's a way to sign them):

/opt/nessus/sbin/nessuscli fix --set nasl_no_signature_check=yes

Check your syntax:

/opt/nessus/bin/nasl -L scan_interference.nasl

Stop nessusd and rebuild the plugins:

systemctl stop nessusd
/opt/nessus/sbin/nessusd -t
systemctl start nessusd

Start tcpdump on its pcap and then start your scan. After the scan is done, you should find the ICMP "label" traffic signaling the beginning of the plugin run or whatever else you decided to mark.

Afterward, remember to restore the original nasl file for the plugin:

systemctl stop nessusd
cp <backup> /opt/lib/nessus/plugins/scan_interference.nasl
/opt/nessus/sbin/nessuscli fix --set nasl_no_signature_check=no
/opt/nessus/sbin/nessusd -R
systemctl start nessusd

Happy debugging!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .