I find manually verifying exploits with Perl scripts to be rewarding, especially with oddball applications. I spend a lot of time scanning custom server applications (HTTP, FTP, etc) and Nessus tends to throw a lot of false positives on these. This usually happens because an earlier attack (sometimes not even listed on the report) took the service out and the plug-ins throw positives afterwards for whatever reason. My strategy involves going one-by-one through the positives that have been reported (filtering so that Nessus only attempts that attack and the services verifications). Usually I can get rid of almost all of the false positives doing this. Then I create a quick Perl script to duplicate the exploit and execute the attack (obviously this does not work for every vulnerability, but for a lot of them it does) for those remaining. Generally, the ones left after going through one by one are valid vulnerabilities, but the Perl script gives that extra confirmation.
On Renaud's note, I have had issues with Nessus detecting custom FTP and SMTP services, but it is not really the fault of Nessus but the programmers as they give no hint as to what the service is actually supposed to be used for (banners, etc) and they are almost always on a non-standard port. ---------------------------------------- The information transmitted in this message is intended only for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document. _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
