Hot answers tagged

16 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
user avatar
  • 3,385
13 votes
Accepted

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

The vulnerability applies in situations where: The attacker can do a MitM at the network level (usually through DNS poisoning or by operating a fake open WiFi access point). A Web site offers some ...
user avatar
8 votes

what is the vulnerability if the DCE service on remote port is enumerated?

If there are any vulnerabilities on the services that the DCE portmapper advertises, then the attacker could use these services to exploit the machine. Also, if there are any accounts with weak ...
user avatar
6 votes

Software for web hacking?

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.
user avatar
  • 123k
6 votes
Accepted

Relationship between CVSS and Risk Level in Nessus output data

generally Nessus severity ratings will line up to the brackets outlined here for CVSS Score --> severity mappping so NVD Vulnerability Severity Ratings NVD provides severity rankings of "Low," "...
user avatar
  • 60.8k
6 votes

Difference between Lynis and Nessus and yet another hardening tool

Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery. I'm curious why you want to start a new project. So let me answer by ...
user avatar
5 votes
Accepted

Nessus Vulnerability Scanner

I am not sure what you mean "on a remote server" but very simply put: yes, you can - as long as you're authorized. If your scenario is to scan server which lies outside of your local network (for ...
user avatar
5 votes
Accepted

Use Nessus or focus on manual testing?

Putting aside that you are using Nessus, let me answer in terms of the use of any web application scanner as a tool. Automated scanners are great tools for a quick, repeatable test that can find the ...
user avatar
  • 123k
5 votes

Attack Metasploitable using Nessus

Nessus is a vulnerability scanner, it's job is to find what vulnerabilities may be present in a target system. It does not actually perform the attack itself (except by accident if it were to ...
user avatar
4 votes

How to exploit via Metasploit vulnerabilities found with Nessus?

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits,...
user avatar
  • 1,150
4 votes
Accepted

Is Nessus approved for PCI Scans?

11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity’s vulnerability ...
user avatar
  • 1,905
4 votes
Accepted

Is it possible to invoke OS commands from a NASL script in OpenVAS?

There is the NASL function pread which allows you to run external commands from within a NASL script. An example to run cat and get its output could be: args = make_list( "cat", # The cmd which is ...
user avatar
  • 302
3 votes

How do I know if a Nessus Scan against a Oracle instance has been sucessful?

You can check the Nessus log to see what checks it performed, what plugins it used / attempted to use. Steps In the scan settings, make sure Log Scan Details to Server is checked Execute the scan ...
user avatar
  • 5,105
3 votes
Accepted

Nessus report shows iSCSI vulnerability

Without sounding pretentious or even giving you a dummy answer that sounds too simple, what you need to do to really see the "meat" of the vulnerability, as well as mitigation solutions and other ...
user avatar
3 votes

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? While the accepted answer explains how port 0 is still a real port, it may be helpful to understand how ports work in TCP. Below is a 32-bit-wide ...
user avatar
  • 64.1k
3 votes

nikto's results differ from other vulnerability scanners , is it more or less accurate?

Why are you looking for the best "starting point"? They all test for different things and each behaves differently. Regardless of the tool, you still need to verify the results, and each tool will be ...
user avatar
  • 123k
3 votes

Patching session fixation issue on Apache server

While the official remediation recommendation from Nessus (as you like know) is to explore patching, it is likely a generic piece of advice. I would agree that there is merit in the suggestion by ...
user avatar
3 votes

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

TL;DR Security scans often require human evaluation to rule out false positives and false negatives. You also have to read the actual definitions of your tool's results to understand what's being said,...
user avatar
2 votes
Accepted

Do I need an ASV to come out when going for an SAQ?

Only the external scan requires an ASV: PCI 3.1 states: 11.2.2 Perform quarterly external vulnerability scans, via an Approved Scanning Vendor (ASV) approved by the Payment Card Industry Security ...
user avatar
2 votes

How does Nessus send remote commands on Windows without RDP?

There are many ways that Nessus, and similar scanners or other utilities, may remotely control or alter systems without RDP enabled. In fact, you'll probably be hard-pressed to find any remote ...
user avatar
  • 27k
2 votes

what is the vulnerability if the DCE service on remote port is enumerated?

Yes, using MSRPC or SMB named pipes, DCE-RPC services can be enumerated. This information can give information about the host, including information about the SAM (i.e., authentication database ...
user avatar
  • 18.9k
2 votes
Accepted

How does Nessus know which services are running in a host?

It really depends on the type of scan you are performing... By default, Nmap scans report these services by making a guess based on the its nmap-services table. The nmap-services file is a registry ...
user avatar
  • 4,259
2 votes

Nessus report shows iSCSI vulnerability

Let's examine this vulnerability from both "definition" and "impact" sides. Definition iSCSI is a protocol (i.e., a way to interface / talk with) associated with SAN disks that are part of a Storage ...
user avatar
2 votes
Accepted

Network Scans Find Absent Device

Why don't you try a nmap -Pn -p 0-65535 scan against the host. The device may not report any ports because it is not responding to pings. Also, is the dns entry there when you perform a nslookup? What ...
user avatar
  • 146
2 votes

How to test CVE-2004-0789 Multiple Vendor DNS Response Flooding Denial Of Service?

The basic Nessus test appears to be replicable by using a hex editor to create a response file ( I used the Nessus google example) and then sending that data to the target DNS server via netcat: so:...
user avatar
  • 21
2 votes
Accepted

Nessus Default Ports

Default = All common ports listed in the configuration file (/etc/services). Extracted from official nessus documentation page.
user avatar
2 votes
Accepted

Nessus keeps detecting mDNS

Uninstalled Nvidia 3D Vision. Didn’t realize 3D vision was the drivers for their 3D glasses. Thought it was one of their critical 3D graphics drivers. It made sense for that to sync with something as ...
user avatar
  • 151
2 votes

What are the benefits of using Nessus in addition to Azure Security Center?

Azure Security Center rather identifies insecure configurations (e.g. missing system updates) than concrete vulnerabilities. While Nessus authenticated scans also cover insecure configurations, they ...
user avatar
  • 600
2 votes
Accepted

Nessus detect more open ports than nmap

If you do not manually specify which ports to scan, nmap will scan the "top 1000" ports, supposedly representing the 1000 most common used ports at some point in time. Some of those ports you have ...
user avatar
2 votes

Trying to understand port tunnelling

That depends on whether or not the jumphost has access to the post on the internal kali's machine. Let's say your Kali machine has the IP 192.168.1.1, the Jumphost has 10.0.1.1 and the internal Kali ...
user avatar
  • 66

Only top scored, non community-wiki answers of a minimum length are eligible