[en] Yet another Mantis XSS

http://HOST/mantis/view_all_bug_page.php?tag_string=%3C/td%3E%3Cscript%3Ealert%2842%29;%3C/script%3E%3Ctd%3E

Found by Nessus torture_cgi_cross_site_scripting.nasl, again...

[en] Nessus: 1 / Mantis: 0

torture_cgi_cross_site_scripting.nasl found that against Mantis 1.1.8:
http://HOST//mantis/view_filters_page.php?target_field=%22%3C/script%3E%3Cscript%3Ealert%2842%29;%3C/script%3E

[en] nmap 5.0 is out

Looks like it slightly leaks memory .
Here it is on a 64 bits system with 4 GB of RAM.
Red: real memory in KB (RSS)
Blue: virtual memory in KB (MEM)
Time is in seconds.

[en] webmasters, tonight, ye dine in hell!

An updated plugin feed has successfuly been pushed.
Serial : 200906191634
Changes :

P DDI_Directory_Scanner.nasl
U display_http_cookies.nasl
P find_service.nasl
U http_audit_settings.nasl
P open_nntp_server.nasl
P opera_925.nasl
P os_fingerprint_http.nasl
U pci_compliance.nbin
U pci_compliance_test_req.nbin
P scan_info.nasl
P sql_injection.nasl
P tomcat_error_version.nasl
U torture_cgi.inc
U torture_cgi_command_exec.nasl
U torture_cgi_cross_site_scripting.nasl
U torture_cgi_directory_traversal.nasl
U torture_cgi_header_injection.nasl
U torture_cgi_remote_file_inclusion.nasl
U torture_cgi_timeout.nasl
P torturecgis.nasl
U web_app_test_settings.nasl
P webmirror.nasl
P websphere_6_1_0_25.nasl
P www_too_long_cookie.nasl
P www_too_long_header.nasl

The old torturecgis.nasl has been deprecated and replaced by torture_cgi_*.nasl.
As far as I know, the new scripts are more efficient, especially the XSS detector.

Nessus forum
Tenable blog

DNS... WTF?

Jan 17 13:53:33 [named] client 69.50.142.11#8500: query (cache) './NS/IN' denied
Jan 17 13:53:34 [named] client 69.50.142.11#62054: query (cache) './NS/IN' denied
Jan 17 13:53:34 [named] client 69.50.142.11#50405: query (cache) './NS/IN' denied
Jan 17 13:53:37 [named] client 69.50.142.11#38682: query (cache) './NS/IN' denied
Jan 17 13:53:39 [named] client 69.50.142.11#47266: query (cache) './NS/IN' denied

# bzgrep -l "client 69.50.142.11#" log-2009-*.bz2
log-2009-01-08-14:01:54.bz2
log-2009-01-16-20:01:54.bz2
log-2009-01-16-23:01:42.bz2
log-2009-01-17-02:01:49.bz2
log-2009-01-17-05:01:55.bz2
log-2009-01-17-08:01:50.bz2
log-2009-01-17-11:01:04.bz2
# bzgrep "client 69.50.142.11#" log-2009-*.bz2 | wc -l
33464
#

Update
I got a quick answer from their hosting company. According to them, the source IP is fake and this is a DOS.
Rather lame, IMHO: a DNS answer is small. If the cracker can fake the source IP, he can directly flood the victim with more data than my DNS server...

[en] Calling Nikto from Nessus

Nikto is a small and fast web scanner written by Sullo. It is based on RFP's LibWhisker.
The nikto.nasl plugin can call it from Nessus. I updated it four months ago to support Nikto2.
The latest Nikto version is 2.02 and it "works for me" with the standard distribution.

Several Nessus users have reported problems running the plugin. Here are the critical points:

• First you need to run the Nessus daemon on Unix. nikto.nasl will not run on Nessus for Windows.
  
• nikto.pl has to be found in $PATH when nessusd is run, i.e. when the plugins are compiled and when the daemon is started. Nessus does not look for any other command name (nikto, nikto.sh, etc.) that may be installed by any distro-tuned package.
  The file (under /opt/nessus/lib/nessus/plugins) is nikto.nasl, the script ID is 14260, the name is "Nikto (NASL wrapper)", you should find in the "CGI abuses" family. If you do not see it, fix your $PATH, make sure that nikto.pl is executable, rerun nessusd -R and restart the daemon.
  A good place to set up $PATH is your Nessus start-up script; try /etc/init.d/nessusd or /etc/init.d/rc
  
• Some people/distros install nikto.pl into a specific directory like /opt/nikto-2.02/ and add a link /usr/local/bin/nikto.pl. This will not work as you need to go into the Nikto directory before launching the command; otherwise, Nikto will not find its data files. Nessus does not read the link and would chdir to /usr/local/bin instead of /opt/nikto-2.02.
  If the plugin is listed, it is run (according to /opt/nessus/var/nessus/nessusd.messages) but it does not produce any output, you may well be in this bad configuration.
  Either remove the link or make sure that /opt/nikto-2.02 appears before /usr/local/bin in $PATH.
  
• Last but not least, nikto.nasl is disabled by default. You'll have to change its preferences (if you are running NessusClient3, edit your policy, click on the "Advanced" tab and select "Nikto (NASL wrapper)"). Change "Enable Nikto" from "no" to "yes".
  

This installation sequence should work:
cd /opt
tar jxvf ..../nikto-2.02.tar.bz2
# This will create a nikto-2.02 directory
# make sure that /opt/nikto-2.02/nikto.pl exists and is executable
PATH=/opt/nikto-2.02:$PATH; export PATH
nessusd -R
killall nessusd # if necessary
nessusd -D # add other options if necessary

The plugin automatically selects some options, like SSL support or virtual host name (which is supported by HTTP/1.1 only). It will not run against web server that do not send back a 404 code on non existent pages, because Nikto is prone to verbose false alerts in that case.
I did not play with all options, some of them may be broken or incompatible with Nessus. Feel free to e-mail me if you find such cases.

[en] Does Vista piss you off?

If Vista pisses you off, don't worry, that's perfectly normal: it was designed to. That's official now:

SAN FRANCISCO--A Microsoft manager has said that one of the security features in Vista was deliberately designed to "annoy users" to put pressure on third-party software makers to make their applications more secure.

Unfortunately, Microsoft software also triggers the PITA (Pain In The A...) function.
It's not a bug, it's a feature.

[en] Nessus 3.2 is out!

Nessus 3.2 was announced on 2008-03-12. It contains many improvements for which I have no responsibility, and a new version of nessus_tcp_scanner.

• Simplified options
  
• Two former boolean options (and a new one that was not seen by anybody but me) were merged into a single Firewall detection four level cursor:
  
• Disabled
• Do not detect RST rate limitation
• Normal / automatic
• Ignore closed ports
• Congestion detection was removed, it is now hidden in nessusd.conf
  
• Scan ports in random order is still here, although I don't think that many people will ever touch it.
• Unfiltered ports are regularly probed.
  I added that first to get a better RTT (ping time) estimation; this is a crucial parameter for a userland TCP scanner. This feature is also (mainly?) used now to detect congestion.
  This piece of code works on any OS and is more sensitive than the previous kernelland (Linux only) detector -- I don't criticize the Penguin, I'm still amazed that this kernelland detector works with a such a psychotic software; portscan is definitely not a "normal" use of a TCP/IP stack.
  As the detector detects rather well, I slightly increased the aggressivity of the cyber-monster.
  I hope that very slow links can now be scanned in a reasonable time without being overloaded even in hellish conditions (lost packets, long & changing RTT), at worst by using the most cautious parameters:
• safe_checks=1
• max_checks=1
• Firewall detection=Disabled
  

To avoid interminable scans (they do not make much sense), the scanner gets restless after 40 minutes (default value). At the first timeout, it moves the aggressivity cursor to the fourth choice (ignore closed ports), at the second, it stops at the end of the current phase, at the third, it does sepuku at once.
Finally, for the ones who are eager to shoot themselves in the foot, here are a few hidden option from nessusd.conf, with their default values:

• nessus_tcp_scanner.send_regular_probes=yes
• nessus_tcp_scanner.unlimited_rtt=no
• nessus_tcp_scanner.portscan_timeout=2400
• use_kernel_congestion_detection=no (was "yes" en 3.0 et 3.1)
• stop_scan_on_disconnect=yes
• nessus_tcp_scanner.max_pass=16

[en] Crude port scanner

It takes less than 2 pages of code, and on a LAN, it is quick and reliable. On a WAN, it is brutal, not very reliable, but not so awful. Writing a smart portscanner is nothing but a waste of time...

• Unix version
• Linux epoll version

[en] Real men don't scan

Portscan is for the weak users who cannot open 65535 sockets at once.

• Unix version
• Linux epoll version

You'll probably need to be root to run this. And you'd better check that you have enough file descriptors on your operating system.

[en] Medusa

Medusa NASL wrappers for Nessus...
http://michel.arboi.free.fr/download/medusa.tgz

NB: you'll have to set nasl_no_signature_check=yes in /opt/nessus/etc/nessus/nessusd.conf
or add my key in /opt/nessus/var/nessus/

[en] Nmap 4.20

Nmap 4.20 is out. I had a look at it, just in case some annoying bugs features were fixed.
Against my good old BSD, nessus_tcp_scanner ran on 352 s (with max_check=4) or 254 s (max_check=5). nmap -T 4 ran in 774 s without --defeat-icmp-rate-limitation, or in 658 s with it. Similar to the previous 11 minutes; no gain.

Considering the memory size, I'm afraid that things did not improved.
Here is the result of "nmap -sS -sV -O -v -p- ..." against a vicious configuration.
Memory sizes are in MB, time in seconds. The blue line is the allocated virtual memory, the red line the occupied RAM; the host machine is 32 bits, with 1.5 GB RAM.

[en] ssh_get_info + Telnet + SNMP

One of my customers never use SSH, but rather Telnet. This is frustrating as ssh_get_info cannot be used. So I patched ssh_get_info.nasl to support other protocols: Telnet, rexec, rsh & rlogin.
The code is now cleaner IMHO, and it should be easier to add more protocols, if this is really necessary.
We have to test all this to check that nothing is broken, do not expect to see this released too soon.

I also wrote a new snmp_get_info.nasl, but few systems give useful information through the (out of the box) SNMP agent: AIX, SuSE...
Maybe this script will never go into the official repository.

[en] Free software & copyrights

Quiz: read this page and try to find all errors.
http://www.webzcan.com/Vulns/WZV11834.html

Hint: source routed packets are an old obsession: I wrote that Nessus script in 2003.

Solution:

1. My name does not appear anywhere on this page.
2. "Nessus" does not appear anywhere on this page.
3. As this is an English text, it is not regulated by software licence but by common copyright.
   

This is just an example: many companies do this, and nobody cares. But when Renaud tries to protect his intellectual property by closing the source code, everybody whines.

We definitely need something stronger than GPL. And maybe a couple of trials...

[en] Ubuntu Security Notices

I've converted Ubuntu security advisories into Nessus "local tests".
Nice distro, by the way...

[en] Nessus and the art of bullshit

Once upon a time, another of my favourite competitors wanted to check if the Windows machines that he was auditing were up to date with security patches.
For whatever reason, he could not start his laptop on Unix (maybe he just could not install Unix, like so many 3L33T security consultants) so he booted a Knoppix or Auditor Live CD, ran Nessus and said "all clear".

There is one little problem: GPL live CD use GPL Nessus, and nearly all Windows tests are © Tenable, they are not included in the GPL Live CDs, as they are available through the direct feed.
It was no use running the test, we already know the result: no problem.

People actually pay for this kind of "audit". Isn't it amazing?

[en] Nessus licence

A while ago, a consultant from a competitor company launched a scan on a live network.
I don't know exactly what tool he used - Nessus or Nmap, I suspect. And I don't know what options he chose.
The main problem is that he probably did not know either.
As a result, the whole network crashed.

There should be a Nessus licence, just like there are driving licences.

[en] New version of nessus_tcp_scanner

The new nessus_tcp_scanner will be quicker but more reliable, I hope. It estimates the Round Trip Time instead of using the default fixed timeout, it runs several passes against a slow target and tries to detect heavily firewalled machines or BSD systems with RST rate limitation. This way, it does a full TCP scan of a BSD system in a couple of minutes instead of eleven.
You'll have to wait for Nessus 2.2.6 to get this marvel.

OK, I should drop this topic and get a life.
Or at least, instead of practicing witchcraft, I should try to build a model for port scan.
Thinking before doing... Looks like a good idea.

[en] Port scanning, again

I scanned a friend's machine a week ago.
nessus_tcp_scanner took 380 s, "nmap -T aggressive" took more than 1500 s.

[update 2005-07-27]
Nmap looks badly broken in some cases, but I was unable to reproduce that as the configuration of the target machine was changed since.
Meanwhile, I broke nessus_tcp_scanner...

[en] Guillermito vs Tegam

At least some excitement in the French computer security little world!
Tegam has found a new protection against security holes: they do not patch, they bring the publisher to justice. As far as I know, they never did the same against virus writers. Isn't it odd?
Finally, Guillermito was lightly condemned because he used a pirated copy of Viguard. The court did not even judge that Guillermito had defamed their software.
All this is not so important, even for Frenchmen: Tegam is a small company, virtually unknown outside of the country.
Anyway, if you intend to buy their products, you'd better read the contract several times.