Re: Validation

On 12/13/07 14:59, First Last wrote:

> How do you validate vulnerabilities Nessus finds? 

It depends on which plugins are involved and how they do their checks.

> I've been working with
> a server for awhile that all of the sudden supposedly has a bunch of 
> vulnerabilities. Below are a few of the ID's. How do I validate that the 
> vulnerability exists or not?
>
> Nessus ID : 11760 
> <http://www.nessus.org/plugins/index.php?view=single&id=11760>
> Nessus ID : 11694 
> <http://www.nessus.org/plugins/index.php?view=single&id=11694>
> Nessus ID : 15908 
> <http://www.nessus.org/plugins/index.php?view=single&id=15908>

These plugins all check for cross-site scripting issues by passing in a 
parameter with Javascript and checking whether the response contains it. 
Given that these (and others apparently) started to report issues only 
recently, I wonder if there's a generic issue with the server itself. 
For example, is there a 404 error document that echoes the query string?

If you've configured plugin dependencies, I would expect that this sort 
of thing would be picked up by plugin #10815 
(cross_site_scripting.nasl), which would then cause those three plugins 
not to be run.

George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus