Hello Pete/All,
I find that vulnerability scanners are useful when they can do credentialed
scans to verify that the services are actually running and check patch
levels based on current patch data and such. Nessus in particular is good
for this, and it also allows you to use it for configuration validation as
well provided that you pay for the commercial feed. There are limitations
though.
Depending on what you find and the policy you are being held to further
validation may need to be done, but I think they're at least a good starting
point as long as you know its not 'point-click-and-ship' and the report is
gospel.
Nothing is better than having the ultimate validation: actual exploit of
said vulnerabilities and having nc running on a host listening for you're
every command ;-) The only issue is you're bound by policy there as well.
My $.02
Thanks.
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Pete Herzog
Sent: Tuesday, July 24, 2007 11:27 AM
To: Pen Test
Cc: security-basics@securityfocus.com
Subject: Re: Vulnerability Assessment
Hi,
Just a thought but why? Why do you want a vulnerability scanning tool? You
never said. How can we help you if you don't tell us why you need it. If
you asked us to help you chose between 2 cars, we couldn't tell you which
to buy unless you told us why you think you need a car and how it will be
used. So I'll give it a shot here:
If you say that you need to keep up on vulnerabilities than you're going in
the wrong direction because they are not that current and you can forget
about verifying against rumored 0days.
If you say you want to verify if the vulnerability is real then you're
going in the wrong direction because they don't usually exploit.
If you say you want to spend a lot of money to make sure that you can check
a whole backlog list of vulnerabilities against various services without
having to think at all but think you can use it to cover your ass to
management then you're right on and get the one that tickles your fancy
(yay, I NEVER get to use that phrase anymore!).
There are easier ways and cheaper ways to do vuln management but they all
require you to do the analysis (not the exploiting). Which means know what
you have and compare it to new exploits that come out. It can even be
automated. When in doubt, you can use a verifying tool like Metasploit or
one of the commercial ones like from Core Security. Classes like the OPSA
or OPST can go a long way to help you out here too.
Sincerely,
-pete.
jfvanmeter@comcast.net wrote:
My two shiny centvos --- I would use Nessus, its free, there is a port to
Windows, you can write you own plugins, I've seen tenable fix fail postives
in a day, if you want to pay for the plug in feed its only 1200 dollars US.
if you pay for the plugin feed you can use the compliance checks, Tenable
has pre configured checks you can download or you can write them yourself.
check it out, www.nessus.org
I'm not a employee of Tenable Security, I've tried all of the others...
Foundscan, retina, ISS, Satan, Saint, etc and I still personnel like Nessus.
-------------- Original message ----------------------
From: "Deepak Parashar" <deep231982@gmail.com>
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
