On Thu, Nov 20, 2003 at 10:56:01AM -0600, Hildebrand, Brian wrote:
> I find manually verifying exploits with Perl scripts to be rewarding, especially
> with oddball applications. I spend a lot of time scanning custom server applications
> (HTTP, FTP, etc) and Nessus tends to throw a lot of false positives on these. This
> usually happens because an earlier attack (sometimes not even listed on the report)
> took the service out
So I assume that you are running the scan without safe checks enabled.
Speaking of best practices, I really want to emphasize the importance of
safe checks :
+ If enabled, Nessus will do its best to find flaws without disrupting
anything on the network. This sometimes involves doing a banner check
instead of actually testing the flaw. In most environments that works
pretty well. It also works well when doing scan on top of highly
unreliable connections (like by DSL provider :)
+ If disabled, you should pay great attention to what plugins you are
enabling. In particular, if you enable the Denial of Services family,
you're not doing a security assessment rather than looking at the
strength of your network. This has useful purposes - if you test a host
which is directly exposed to the internet, a full scan should be done,
as it's probably what your server will be exposed to, someday.
The downside is that if a service goes down because of check (A), check
(B) might claim to be the one who did it. Most of the plugins check that
the service is still running before testing it, but some don't.
When you see such results, *PLEASE* send me your report and I will fix
the plugins in question. If you stay silent then it's way harder for me
to fix such incoherencies.
The bottom line is that Nessus may produce false positives if you
configure it to, and likewise it may produce extremely few of them if
you configure it properly.
My rule of thumb is :
- Internal scan of a typical corporate network (fairly recent
Windows workstations, a couple of servers) : safe checks and
optimizations should be enabled
- Host in the DMZ : *once secured* by a safe checks scan, throw
everything at it.
You have thousands of other scenarios, but these really are the most two
commons.
-- Renaud
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
