George
I have two specific situations:
ISS NIDS/HIDS listens (at least part of the time on tcp/12345 which
Nessus mis-identifies as Netbus. ISS also installs a listening telnet
server on it's monitoring station. I can't remember here the exact name
they've given the *exe.
Additionally Dell Open Server Manager installs vnc listening on a non
standard port. Nessus thinks this is a trojan as well.
I guess my thought is if I know they are running this can I "flag" these
ports in any way?
Jim Kelly
-----Original Message-----
On most of my scans, Nessus has identified what it labels
"unknown" ports. I have resolved what service is listening
on these "unknown" service ports by pulling the results of
the command netstat -anp off Windows 2003 servers. Once I
have this output I then goodgle the *.exe file that
netstat says is listening.
My question is, does anyone have a more elegant way to run
these ports down?
Sometimes you can learn about a service by connecting to the
port and entering various commands, which is essentially
what the find_service* plugins do. But otherwise, your
approach is probably the most effective, I'm afraid.
Once I get the results, I figure that I'd like to save the
results for the next scan...can/should I add these to
nessus port mapping file?
A better solution would be to help us modify the
find_service* plugins so that the more significant services
can be recognized by Nessus directly. The only problem is
that rather than working with file names we'll need traffic
dumps. If Michel Arboi, the author of these plugins, doesn't
respond in a day or two, drop me a note and I'll work with
you on it.
George
--
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
