Re: How does Nessus work without compromising the target?

On Thu, Jul 28, 2005 at 01:20:55PM -0400, Lu, Xi wrote:

> Can someone help me understand how Nessus works without crashing the
> target machine?

It does this in the same way you'd probably do it if you didn't have a
tool such as Nessus to use; eg,

  o Get the installed version locally
    With the right credentials, Nessus may be able to gather
    version information from the target locally by, say,
    checking the registry or running rpm.

  o A banner check
    These aren't always reliable because banners can generally be
    hidden / faked, and software distributed as part of a package
    often fixes the flaw without changing the banner.

  o Check for an associated flaw.
    If the software is affected by multiple flaws, one of which
    is a buffer overflow and others are not, you may be able
    to check for the other flaws and be reasonably sure the
    buffer overflow exists.

Even so, there are some cases in which the only option is to try to
exploit the flaw directly, and Nessus will use that too provided safe
checks have been disabled (they're not, by default).

George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus