Hi Juan,
Don't worry, no one is perfect. You'll surely improve over time ;-)
Now to your question. Don't throw everything but the kitchen sink to the
server. Usually one or two vulnerability assessment tools are more than
enough, and Nessus (if kept up to date) is fairly reliable.
The questions you've to ask are different, for example (and in no
particular order):
1) I'm running IIS, Apache, whatever, and Nessus reports problem XXXXX. Do
I know how to verify if this problem is true or a false positive. If it's
true... Do I know how to patch it?
2) How often do I update Nessus (main executable) and the NASL plugins?
3) Are my servers running any kind of web application that can be prone to
other types of attacks? (Examples: password bruteforcing, SQL Injection,
path/information disclosure, command execution, Java/ASP/whatever source
code disclosure, etc)
4) Are there any OTHER avenues of attack other than the webservers? Other
services? Other servers? Vulnerable network devices?
5) Is the configuration of the DMZ "watertight"? (In particular:
connections STARTING in the DMZ must be forbidden).
6) Do a port scan to all machines/devices in the DMZ, deactivate anything
that's not needed, and keep that information as your baseline
7) etc ;-)
You can combine Nessus with Nikto to help *a bit* with web application
testing, if you're using one or more web apps, but the art of pen-testing
web applications hasn't been automated, yet ;-)
Last words: start to learn and practice to BE a hacker. At least to think
like one. Remember that hackers are not bad guys, it's just the bad press.
Cheers,
Miguel
aka Nekromancer
Juan B <juanbabi@yahoo.com>
22/11/2004 14:56
To: security-basics@securityfocus.com
cc: (bcc: Miguel Dilaj/PH/Novartis)
Subject: Please help ! need to check IIS volunrabilities.
Hi,
Im a sys admin new to security,
I want to scan all the web servers we have in the DMZ
for volunrabilities I check them with Retina and
Nessus.
What else to check? and with which tool ?
I AM NOT A HACKER !
thanks !!
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - Get yours free!
http://my.yahoo.com
