Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Nessus-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Empty reports vary whether host is in same LAN than Nessus or not

from [Federico Petronio] Network Security [Permanent Link]
Subject: Re: Empty reports vary whether host is in same LAN than Nessus or not
Date: Thu, 18 Jan 2007 13:12:06 -0300 
These are the ping related lines in my conf. file:

 Ping the remote host[entry]:TCP ping destination port(s) : =
21;22;23;25;53;79;80;110;111;113;119;135;139;143;264;265;389;443;444;445;636;993;995;1433;1454;1494;1720;1723;3128;3306;3389;5001;7100;7200;7409;8080;8000;9080;10060;10080
 Ping the remote host[checkbox]:Log live hosts in the report = no
 Ping the remote host[checkbox]:Do an applicative UDP ping (DNS,RPC...) = no
 Ping the remote host[entry]:Number of retries (ICMP) : = 6
 Ping the remote host[checkbox]:Do an ARP ping = yes
 Ping the remote host[checkbox]:Do a TCP ping = yes
 Ping the remote host[checkbox]:Do an ICMP ping = yes
 Ping the remote host[checkbox]:Make the dead hosts appear in the report
= yes


Renaud Deraison wrote:


On Jan 17, 2007, at 7:23 PM, Federico Petronio wrote:


Hello list,

I would like to ask about a behavior I found in Nessus and that I am not
sure if it is the expected.

I am running Nessus 3.0.4 over Linux Debian 3.1 (Sarge) and setup two
different scans, (1) with a target in the same network that the Nessus
engine and the other (2) with the target in a different network. Both
target IPs are not in use, so Nessus will get no answer at all from any
of them.

After running the scans and getting the results in XML format I found
that the <results></results> section is completely empty for scan (2)
but for the scan (1) I get:
[...]

Do you know why the difference? I guess it has to be with the fact that
the result for pinging both host is not the same: not event the ARP
request is answered for the local host, but packets to remote host are
directly sent to the default gateway.


It sounds like that you configured ping_host.nasl to solely do an ARP
ping, which is only tried when the remote target is on the local LAN.

Enable TCP/UDP/ICMP ping in ping host and try again.



                -- Renaud
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus




-- 
                                        Federico Petronio
                                        petrus@activesec.biz
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Plugin ID : 19552 Question, jfvanmeter
Next by Date:  Re: Plugin ID : 19552 Question, George A. Theall
Previous by Thread:  Re: Empty reports vary whether host is in same LAN than Nessus or not, Renaud Deraison
Next by Thread:  Invalid response file, Frank OSborne
Indexes:  [Date] [Thread] [Top] [All Lists]