Hot answers tagged

17

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are designed it's not that easy to bind on port zero, it's nevertheless possible to use it. However, it's highly unlikely that this is actually happening in your ...


13

The vulnerability applies in situations where: The attacker can do a MitM at the network level (usually through DNS poisoning or by operating a fake open WiFi access point). A Web site offers some services over HTTPS. Some parts of the Web site require a user authentication. The Web server accepts to to SSL/TLS renegotiations. The Web server is ready to ...


7

If there are any vulnerabilities on the services that the DCE portmapper advertises, then the attacker could use these services to exploit the machine. Also, if there are any accounts with weak passwords setup on those services then you should be concerned. Nessus will scan the former, assuming those ports are in scope, and the latter will come down to the ...


6

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.


6

generally Nessus severity ratings will line up to the brackets outlined here for CVSS Score --> severity mappping so NVD Vulnerability Severity Ratings NVD provides severity rankings of "Low," "Medium," and "High" in addition to the numeric CVSS scores but these qualitative rankings are simply mapped from the numeric CVSS base scores: ...


5

Putting aside that you are using Nessus, let me answer in terms of the use of any web application scanner as a tool. Automated scanners are great tools for a quick, repeatable test that can find the most common issues with websites. I would never develop without running automated tools. But, one always has to understand that these tools come with serious ...


5

I am not sure what you mean "on a remote server" but very simply put: yes, you can - as long as you're authorized. If your scenario is to scan server which lies outside of your local network (for example a different server belonging to your company, hosted somewhere else) Nessus is your choice. If you mean you want to perform a scan from a remote server ...


5

Nessus is a vulnerability scanner, it's job is to find what vulnerabilities may be present in a target system. It does not actually perform the attack itself (except by accident if it were to accidentally DOS the target with an unsafe check). Instead you should use to the results of the Nessus scan to use other tools, like Metasploit to perform the attack


5

Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery. I'm curious why you want to start a new project. So let me answer by sharing some background about the Lynis project: The project is almost 10 years old. It got a lot of iterations to improve the tool to where it is now. More ...


4

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


4

11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity’s vulnerability ranking (per Requirement 6.1). Scans must be performed by qualified personnel. For internal scans you could use Nessus as long as you have documented ...


4

There is the NASL function pread which allows you to run external commands from within a NASL script. An example to run cat and get its output could be: args = make_list( "cat", # The cmd which is called, needs to be in cmd as well "/etc/passwd" ); ret = pread( cmd:"cat", # The command to run argv:args, # The arguments list ...


3

You can check the Nessus log to see what checks it performed, what plugins it used / attempted to use. Steps In the scan settings, make sure Log Scan Details to Server is checked Execute the scan After the scan, check the log file in: /opt/nessus/var/nessus/logs/nessusd.messages


3

Without sounding pretentious or even giving you a dummy answer that sounds too simple, what you need to do to really see the "meat" of the vulnerability, as well as mitigation solutions and other details, is to drill down into the hosts that contain the vulnerability. Click on the vulnerability itself and then on the plugin ID#; this will give you a ...


3

How could a IANA reserved port(tcp/0) handle traffic? While the accepted answer explains how port 0 is still a real port, it may be helpful to understand how ports work in TCP. Below is a 32-bit-wide diagram of the a TCP packet, to scale. UDP is similar, although a lot simpler (after the ports, it has just a length field and a checksum field before the data)...


3

Why are you looking for the best "starting point"? They all test for different things and each behaves differently. Regardless of the tool, you still need to verify the results, and each tool will be better at some sites than others. The best one to start with is the one that offers the best value to you for that web application. Then run the others ...


3

While the official remediation recommendation from Nessus (as you like know) is to explore patching, it is likely a generic piece of advice. I would agree that there is merit in the suggestion by symcbean that the web server (Apache in your case) is potentially not the root cause, rather the code that it is serving. There are some useful resources for ...


2

Nessus 5 made a change: It's in the Preferences section: Login configurations HTTP login page There you can set your HTTP credentials/settings. This is a basic check in the documentation. Why go Google, when you can RTFM....


2

Nessus has the information posted on their page with a full walk through. http://www.tenable.com/tips/how-to-enable-credentialed-checks-on-windows


2

Nessus isn't a tcp scanner. Nmap is a scanner which finds open ports, Nessus is a vulnerability assessment tool which first uses a scanner to find open tcp and udp ports then then performs tests on the services found. Some of the tests it can do are intrusive and should only be chosen by looking at the risks.


2

Only the external scan requires an ASV: PCI 3.1 states: 11.2.2 Perform quarterly external vulnerability scans, via an Approved Scanning Vendor (ASV) approved by the Payment Card Industry Security Standards Council (PCI SSC). Perform rescans as needed, until passing scans are achieved. It is only on internal scans where you can run a tool such as ...


2

There are many ways that Nessus, and similar scanners or other utilities, may remotely control or alter systems without RDP enabled. In fact, you'll probably be hard-pressed to find any remote management utility or vulnerability scanner that requires RDP. Remote Desktop is mainly for the human user. Graphical interfaces help us to more easily interpret and ...


2

Yes, using MSRPC or SMB named pipes, DCE-RPC services can be enumerated. This information can give information about the host, including information about the SAM (i.e., authentication database containing the host credentials) or Security (e.g., service and domain credentials) subsystems. The DCE-RPC IFIDs (interface identification numbers) can be used to ...


2

It really depends on the type of scan you are performing... By default, Nmap scans report these services by making a guess based on the its nmap-services table. The nmap-services file is a registry of port names to their corresponding number and protocol. Each entry has a number representing how likely that port is to be found open. This file was originally ...


2

Let's examine this vulnerability from both "definition" and "impact" sides. Definition iSCSI is a protocol (i.e., a way to interface / talk with) associated with SAN disks that are part of a Storage Area Network. What it means is, you can interact with the SAN disks using tools that implement this protocol (e.g., iscsiadm can be used to talk to a SAN disk). ...


2

Why don't you try a nmap -Pn -p 0-65535 scan against the host. The device may not report any ports because it is not responding to pings. Also, is the dns entry there when you perform a nslookup? What happens when you ping -a the phantom device? Can you track the location to a subnet specific to a switch and then look at the stats on the switch? What does ...


2

The basic Nessus test appears to be replicable by using a hex editor to create a response file ( I used the Nessus google example) and then sending that data to the target DNS server via netcat: so: od -ah dns-response-dos.txt 0000000 ` x enq etx nul soh nul nul nul nul nul nul etx w w w f860 8385 0100 0000 0000 0000 7703 ...


2

Default = All common ports listed in the configuration file (/etc/services). Extracted from official nessus documentation page.


2

Uninstalled Nvidia 3D Vision. Didn’t realize 3D vision was the drivers for their 3D glasses. Thought it was one of their critical 3D graphics drivers. It made sense for that to sync with something as convenient as mDNS.


2

Azure Security Center rather identifies insecure configurations (e.g. missing system updates) than concrete vulnerabilities. While Nessus authenticated scans also cover insecure configurations, they additionally discovers vulnerable installed software (e.g. through CVE matching). I dont think that the Azure Security Center sees itself as vulnerability ...


Only top voted, non community-wiki answers of a minimum length are eligible