On Fri, 26 Mar 2004, Flickema, Drew W. wrote: > I have a pilot program in place using SPI Dynamics WebInspect (WI) > product to scan my environment for possible SQL Injection in web > applications. I have ran across the following paper; > http://www.tenablesecurity.com/white_papers/sec_test_light_newt_nessus1. > pdf , which suggests Nessus may be able to detect SQL and XSS > vulnerabilities. The paper is dated Jan 2, 2004, so it is relatively > new. I followed the suggestions of this paper to run a head to head > test against WI. There exists a website to test against, > http://endo.webappsecurity.com . I discovered that WI found 2 SQL > Injection vulnerabilities whereas Nessus found none. Nessus did > discover the CVS directory and expanded the root tree. > One thing I thought might be happening is that the website to test > against is owned by SPI and they have programmed in to watch for Nessus > scans to force false negatives. > Is there anyone successfully using sql_injection.nasl and > tourturecgis.nasl to discover SQL or XSS vulnerabilities? I would be > interested in either an offline or online discussion.
Yeah, I used it a lot :-) You'll need to give webmirror.nasl and sql_injection.nasl some time to finish....i.e. these aren't 10 second tests. I'm very curious of the two SQL Injection bugs that existed but were not found by Nessus....Personally, the first time I ran sql_injection.nasl against a large Corporate environment, I came away with more than 200 bugs...hit me up offline, if you don't want to discuss the bugs on a public list :-) John Lampe jwlampe -at- nessus.org http://f00dikator.aceryder.com/ _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
