On Thu, Jan 24, 2002 at 09:59:19AM -0500, Zurba, Joseph wrote:
> I've recently compiled the newest "stable" release of Nessus and have run
> several tests against some web servers. The results from the scan show a
> huge number, at least 40 each, of false positives on port 80. Most of the
> false positives involve cgi-bin. None of the servers have a cgi-bin
> directory, real or virtual.
>
> Nessus also incorrectly identifies the operating system of each of the
> servers. They are all running NT. Nessus, or rather Queso seems to think
> that they're Reliant Unix. I have tried changing the checks_read_timeout
> value anywhere from 5 to 25 but still get similar results.
>
> As a sanity check I have compared the scans with a recent cybercop scan run
> against the same machines. Cybercop reports 21 infos and/or holes. Nessus is
> reporting 68 infos and/or holes. Any ideas on this? The nessus server
> portion is running on Solaris 8.
Use Nessus 1.1.x and enable the 'optimize the test' option in the
client. You'll also want to install nmap so that QueSO (which is
unreliable anyway) is not used any more.
-- Renaud
