Re: Nessus Digest, Vol 20, Issue 12

On Tue Jun 14 2005 at 19:13, Kelly, Jim wrote:

> ISS NIDS/HIDS listens (at least part of the time on tcp/12345 which
> Nessus mis-identifies as Netbus. 

Which plugin says this?
If it is trojan_horses.nasl, it does not "identify" anything, it
just says it found an open port that is commonly used by some Trojan
horse(s). And this script can be disabled by setting the "paranoia
level" to "avoid FP". Maybe we should only run this script in
"paranoid" mode.

> ISS also installs a listening telnet server on it's monitoring
> station. I can't remember here the exact name they've given the *exe.

Is there a banner when you connect to this port?

> Additionally Dell Open Server Manager installs vnc listening on a non
> standard port. 

VNC should be identified by find_service.nes
Anything special with this server? When you connect to its port, do
you see something like this?
RFB 003.003

-- 
arboi@alussinan.org     http://arboi.da.ru
NASL2 reference manual http://michel.arboi.free.fr/nasl2ref/
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus