Re: Find web proxy servers

At 08:54 AM 10/27/2005, Shahid Sharif wrote:

> Hi,
>
> Are there any checks that I can enable to look specifically for web 
> proxies in my environment?
>
> Thank you
> Shahid Sharif

It depends what you want to find. If you want to find a specific web proxy
tool like "squid", Nessus should find them through service discovery. If
you are more interested in just finding anything that can proxy a web
or even TCP connection, you should start by looking at plugins 10192,
10195 and 10194.

There are also a several vulnerabilities in commercial and open source proxy
tools. Just typing the word 'proxy' into the search interface at:

http://www.nessus.org/plugins/index.php?view=search

is also a good way to find out other web proxy issues you might be interested
in your environment for.

If you are looking to audit proxies that are supposed to be there, you can
also tune your scans to look just for the common web and web proxy ports.
But if you are looking for things that may have been installed by spyware,
perhaps to relay SPAM mail, you should consider doing a full port scan.

For example, we've seen a lot of backdoor web-proxy programs installed on
ports above 32,000 used by the evil SPAMers.

Hope this helps.

Ron Gula, CTO
Tenable Network Security


_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus