Re: OS Identification (Plugin 11936)

Ray Van Dolson wrote:
> On Fri, Jul 18, 2008 at 08:15:22AM -0700, Ray Van Dolson wrote:
> > Hi all, per this blog:
> >
> >   http://blog.tenablesecurity.com/nessus/page/3/ (search down the page
> >     for 11936)
> >
> > The listed plugins are used to determine the identify of the OS on the
> > target host.  I don't see output of telnet listed there -- would this
> > be ignored as a factor in determining the OS?  In other words:
> >
> > $ telnet hostname
> > Trying 10.27.52.76...
> > Connected to hostname.
> > Escape character is '^]'.
> > Red Hat Enterprise Linux Server release 5.2 (Tikanga)
> > Kernel 2.6.18-92.1.6.el5 on an x86_64
> > login:
> > telnet> quit
> >
> > It seems that this could be used with a high degree of confidence in
> > determining that this machine is a RHEL 5.2 machine :)  Instead, with
> > the above host and 11936 enabled, I get only a 30% chance that the
> > machine is running the "Linux kernel".
> >
> > Anyone know on the telnet thing?
>
> I've modified the os_fingerprint_telnet.nasl plugin to do Linux
> detection based on the telnet banner.
>
> What's the best way to get my changes submitted to Tenable for
> inclusion in future releases of this plugin?
>
> Guess I'll start by opening a ticket, but maybe someone here can point
> me in the right direction.

As the blog entry said, please email os-signatures@nessus.org. We get
many submissions on various OS ID entries and they are updated very
frequently.

Ron Gula
Tenable Network Security



_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus