[en] Yet another Mantis XSS

http://HOST/mantis/view_all_bug_page.php?tag_string=%3C/td%3E%3Cscript%3Ealert%2842%29;%3C/script%3E%3Ctd%3E

Found by Nessus torture_cgi_cross_site_scripting.nasl, again...

[en] Nessus: 1 / Mantis: 0

torture_cgi_cross_site_scripting.nasl found that against Mantis 1.1.8:
http://HOST//mantis/view_filters_page.php?target_field=%22%3C/script%3E%3Cscript%3Ealert%2842%29;%3C/script%3E

[fr] le lièvre, la tortue et le portscanner

Je loue depuis peu un petit serveur disposant d'une connexion à 100 Mb/s sur Internet. J'ai scanné ma connexion ADSL depuis la bête. Le RTT fluctue entre 35 et 70 ms environ.
nessus_tcp_scanner: 15 ports ouverts, 1 port rejeté, 3 ports silencieux, 65516 ports fermés. Tout ça en 101 s.
nmap v4.53, aggressive timing (-T 4): 15 ports ouverts,4 ports filtrés, 65516 ports fermés. En 658 s.
Répétez après moi: "nmap est le meilleur scanner du marché".

[en] Calling Nikto from Nessus

Nikto is a small and fast web scanner written by Sullo. It is based on RFP's LibWhisker.
The nikto.nasl plugin can call it from Nessus. I updated it four months ago to support Nikto2.
The latest Nikto version is 2.02 and it "works for me" with the standard distribution.

Several Nessus users have reported problems running the plugin. Here are the critical points:

• First you need to run the Nessus daemon on Unix. nikto.nasl will not run on Nessus for Windows.
  
• nikto.pl has to be found in $PATH when nessusd is run, i.e. when the plugins are compiled and when the daemon is started. Nessus does not look for any other command name (nikto, nikto.sh, etc.) that may be installed by any distro-tuned package.
  The file (under /opt/nessus/lib/nessus/plugins) is nikto.nasl, the script ID is 14260, the name is "Nikto (NASL wrapper)", you should find in the "CGI abuses" family. If you do not see it, fix your $PATH, make sure that nikto.pl is executable, rerun nessusd -R and restart the daemon.
  A good place to set up $PATH is your Nessus start-up script; try /etc/init.d/nessusd or /etc/init.d/rc
  
• Some people/distros install nikto.pl into a specific directory like /opt/nikto-2.02/ and add a link /usr/local/bin/nikto.pl. This will not work as you need to go into the Nikto directory before launching the command; otherwise, Nikto will not find its data files. Nessus does not read the link and would chdir to /usr/local/bin instead of /opt/nikto-2.02.
  If the plugin is listed, it is run (according to /opt/nessus/var/nessus/nessusd.messages) but it does not produce any output, you may well be in this bad configuration.
  Either remove the link or make sure that /opt/nikto-2.02 appears before /usr/local/bin in $PATH.
  
• Last but not least, nikto.nasl is disabled by default. You'll have to change its preferences (if you are running NessusClient3, edit your policy, click on the "Advanced" tab and select "Nikto (NASL wrapper)"). Change "Enable Nikto" from "no" to "yes".
  

This installation sequence should work:
cd /opt
tar jxvf ..../nikto-2.02.tar.bz2
# This will create a nikto-2.02 directory
# make sure that /opt/nikto-2.02/nikto.pl exists and is executable
PATH=/opt/nikto-2.02:$PATH; export PATH
nessusd -R
killall nessusd # if necessary
nessusd -D # add other options if necessary

The plugin automatically selects some options, like SSL support or virtual host name (which is supported by HTTP/1.1 only). It will not run against web server that do not send back a 404 code on non existent pages, because Nikto is prone to verbose false alerts in that case.
I did not play with all options, some of them may be broken or incompatible with Nessus. Feel free to e-mail me if you find such cases.

[en] Nessus 3.2 is out!

Nessus 3.2 was announced on 2008-03-12. It contains many improvements for which I have no responsibility, and a new version of nessus_tcp_scanner.

• Simplified options
  
• Two former boolean options (and a new one that was not seen by anybody but me) were merged into a single Firewall detection four level cursor:
  
• Disabled
• Do not detect RST rate limitation
• Normal / automatic
• Ignore closed ports
• Congestion detection was removed, it is now hidden in nessusd.conf
  
• Scan ports in random order is still here, although I don't think that many people will ever touch it.
• Unfiltered ports are regularly probed.
  I added that first to get a better RTT (ping time) estimation; this is a crucial parameter for a userland TCP scanner. This feature is also (mainly?) used now to detect congestion.
  This piece of code works on any OS and is more sensitive than the previous kernelland (Linux only) detector -- I don't criticize the Penguin, I'm still amazed that this kernelland detector works with a such a psychotic software; portscan is definitely not a "normal" use of a TCP/IP stack.
  As the detector detects rather well, I slightly increased the aggressivity of the cyber-monster.
  I hope that very slow links can now be scanned in a reasonable time without being overloaded even in hellish conditions (lost packets, long & changing RTT), at worst by using the most cautious parameters:
• safe_checks=1
• max_checks=1
• Firewall detection=Disabled
  

To avoid interminable scans (they do not make much sense), the scanner gets restless after 40 minutes (default value). At the first timeout, it moves the aggressivity cursor to the fourth choice (ignore closed ports), at the second, it stops at the end of the current phase, at the third, it does sepuku at once.
Finally, for the ones who are eager to shoot themselves in the foot, here are a few hidden option from nessusd.conf, with their default values:

• nessus_tcp_scanner.send_regular_probes=yes
• nessus_tcp_scanner.unlimited_rtt=no
• nessus_tcp_scanner.portscan_timeout=2400
• use_kernel_congestion_detection=no (was "yes" en 3.0 et 3.1)
• stop_scan_on_disconnect=yes
• nessus_tcp_scanner.max_pass=16

[fr] Nessus 3.2 est sorti!

Nessus 3.2 est sorti le 12/03/2008 et outre moult améliorations dans lesquelles je n'ai pas trempé because closed source, il inclut une nouvelle version de nessus_tcp_scanner.

• Préférences simplifiées
• Deux anciennes options booléennes (et une nouvelle que personne n'a jamais vue) ont été fusionnées en un seul curseur Firewall detection, qui offre 4 niveaux:
  
• Disabled
• Do not detect RST rate limitation
• Normal / automatic
• Ignore closed ports
• Congestion detection a été supprimée, elle est maintenant cachée dans nessusd.conf
  
• L'option Scan ports in random order reste, bien que je ne sois pas sûr que grand monde la touche.
• Les ports non filtrés sont régulièrement sondés.
  J' avais ajouté ça dans un premier temps pour obtenir une meilleure estimation du RTT (ping time), paramètre crucial pour un TCP scanner en userland. On s'en sert aussi (surtout?) pour détecter la congestion.
  Ce code marche sur tous les OS et est plus sensible que le détecteur kernelland de Linux précédemment utilisé (ne critiquons pas le pingouin, que ce détecteur kernel fonctionne avec un logiciel aussi psychopathe qu'un portscanner est miraculeux).
  Le détecteur détectant bien, j'ai un peu lâché la bride du monstre.
  J'espère que les liens très lents pourront être scannés en un temps raisonnable sans être surchargés même dans des conditions infernales (pertes de paquets, RTT important et fluctuant), en mettant les paramètres au minimum dans le pire des cas:
• safe_checks=1
• max_checks=1
• Firewall detection=Disabled
  

Pour éviter les scans interminables, qui n'ont pas grand sens, le scanner s'impatiente au bout d'un temps de 40 min par défaut. Au premier coup de gong, il pousse le curseur d'agressivité à fond, au second, il termine la passe en cours et s'arrête, au troisième, il fait sepuku immédiatement.
Enfin, pour ceux qui ont envie de se tirer dans le pied, la bête offre quelques options cachées dans nessusd.conf, dont voici les valeurs par défaut:

• nessus_tcp_scanner.send_regular_probes=yes
• nessus_tcp_scanner.unlimited_rtt=no
• nessus_tcp_scanner.portscan_timeout=2400
• use_kernel_congestion_detection=no (c'était "yes" en 3.0 et 3.1)
• stop_scan_on_disconnect=yes
• nessus_tcp_scanner.max_pass=16

[en] Medusa

Medusa NASL wrappers for Nessus...
http://michel.arboi.free.fr/download/medusa.tgz

NB: you'll have to set nasl_no_signature_check=yes in /opt/nessus/etc/nessus/nessusd.conf
or add my key in /opt/nessus/var/nessus/

[en] ssh_get_info + Telnet + SNMP

One of my customers never use SSH, but rather Telnet. This is frustrating as ssh_get_info cannot be used. So I patched ssh_get_info.nasl to support other protocols: Telnet, rexec, rsh & rlogin.
The code is now cleaner IMHO, and it should be easier to add more protocols, if this is really necessary.
We have to test all this to check that nothing is broken, do not expect to see this released too soon.

I also wrote a new snmp_get_info.nasl, but few systems give useful information through the (out of the box) SNMP agent: AIX, SuSE...
Maybe this script will never go into the official repository.

[en] Free software & copyrights

Quiz: read this page and try to find all errors.
http://www.webzcan.com/Vulns/WZV11834.html

Hint: source routed packets are an old obsession: I wrote that Nessus script in 2003.

Solution:

1. My name does not appear anywhere on this page.
2. "Nessus" does not appear anywhere on this page.
3. As this is an English text, it is not regulated by software licence but by common copyright.
   

This is just an example: many companies do this, and nobody cares. But when Renaud tries to protect his intellectual property by closing the source code, everybody whines.

We definitely need something stronger than GPL. And maybe a couple of trials...

[en] Ubuntu Security Notices

I've converted Ubuntu security advisories into Nessus "local tests".
Nice distro, by the way...

[en] Nessus and the art of bullshit

Once upon a time, another of my favourite competitors wanted to check if the Windows machines that he was auditing were up to date with security patches.
For whatever reason, he could not start his laptop on Unix (maybe he just could not install Unix, like so many 3L33T security consultants) so he booted a Knoppix or Auditor Live CD, ran Nessus and said "all clear".

There is one little problem: GPL live CD use GPL Nessus, and nearly all Windows tests are © Tenable, they are not included in the GPL Live CDs, as they are available through the direct feed.
It was no use running the test, we already know the result: no problem.

People actually pay for this kind of "audit". Isn't it amazing?

[en] Nessus licence

A while ago, a consultant from a competitor company launched a scan on a live network.
I don't know exactly what tool he used - Nessus or Nmap, I suspect. And I don't know what options he chose.
The main problem is that he probably did not know either.
As a result, the whole network crashed.

There should be a Nessus licence, just like there are driving licences.

[en] New version of nessus_tcp_scanner

The new nessus_tcp_scanner will be quicker but more reliable, I hope. It estimates the Round Trip Time instead of using the default fixed timeout, it runs several passes against a slow target and tries to detect heavily firewalled machines or BSD systems with RST rate limitation. This way, it does a full TCP scan of a BSD system in a couple of minutes instead of eleven.
You'll have to wait for Nessus 2.2.6 to get this marvel.

OK, I should drop this topic and get a life.
Or at least, instead of practicing witchcraft, I should try to build a model for port scan.
Thinking before doing... Looks like a good idea.

[en] Port scanning, again

I scanned a friend's machine a week ago.
nessus_tcp_scanner took 380 s, "nmap -T aggressive" took more than 1500 s.

[update 2005-07-27]
Nmap looks badly broken in some cases, but I was unable to reproduce that as the configuration of the target machine was changed since.
Meanwhile, I broke nessus_tcp_scanner...

[en] There shall be weeping and gnashing of teeth

Tenable Security has changed the way Nessus plugins are distributed. There are now two feed:

• one for the ~ 3000 GPL plugins: they are available freely and can be redistributed freely.
  
• one for the ~ 3000 Tenable plugins. To get them, you have to register, and pay if you want them at once, or get them with a delay of one week.

This modification is not a licence change: Renaud has been warning for years on the mailing lists that some plugins were not necessarily GPLed.
It is not really a surprise either: Tenable is a privately owned company and has to make money. This move clearly targets ASP which resell Nessus and the plugins without authorization, often violating the GPL and intellectual property of C code or plugins contributers.

As usual, some people were pissed off by this move and yelled on the mailing list, mostly for bad reasons.
I did not hear them when ASP violated my intellectual property.
Strange, isn't it?

[en] Slackware "local tests"

I have finished my conversion tool from SSA to NASL. Nessus will be able to do "local tests" on Slackware (i.e. check through an SSH connection that all patches are applied)
Once again, parsing English in Perl was easier than processing XML.
What's the use of this buzzword compliant crap? Can anybody tell?

[fr] Slackware Security Advisories

J'ai écrit une moulinette de conversion des avis de sécurité Slackware en NASL (nessus Attack Script Language). Une fois encore, parser de l'anglais a été plus rapide que traiter du XML.

En résumé, au cas où vous n'auriez pas compris, XML c'est gros, c'est moche et ça ne sert à rien.
Ça va mieux en le disant.

[en] Zen and the art of automation

I dislike doing a silly job. And I really hate doing it twice.
Whenever I have to do such a f*ing job, I give it to a robot. Robots do not complain, never get tired and are usually better than me for any task that do not require a brain.
Working on robots is more fun than doing silly jobs.
That's why I work on Nessus. Not the only reason, but the main one: looking for security patches on a server is definitely stupid, 150000 lines of C will do it well.
(some stupid tasks need a little subtlety and more than one page of Perl)

Nessus is working, and rather well (much better than its competitors in my humble but biaised opinion) and anybody who'd want to spend a little energy could write patches or test plugins, or concentrate on higher level tasks, like deciding if the whole IT system is vulnerable, to which threat, which sensitive data is exposed, etc.
Nessus scans each machine independantly of the others, and it does not know your network architecture or the sensitivity of your data or servers; in fact, it is not his job, it is ours.

It seems that I overestimate human beings. I know that homo sapiens sapiens is not that sapiens, but I have not lost all hope that people sometimes wants to improve, some way or another.
Many people have improved indeed: they were lusers, they became "security consultants". They run Nessus and sell the raw report.
Added value: none.

After WW3, only robots will survive.
Good.

[en] Yet Another TCP Scanner

I wrote a new TCP scanner, at last.

• It was easy.
• It is simple (less than two pages of C)
• It is quick, even against a firewalled machine
• It grabs banners, and save times for the service identification phases later.

Of course, it doesn't have all the bells & whistles of more advanced scanners like Nmap, but in most cases, we don't need them.

[fr] Port scanner...

J'ai écrit un port scanner TCP ce week-end. J'aurais dû le faire plus tôt.
- il va vite, même contre une machine méchamment firewallée
- il ramasse aussi les bannières des services, ce qui économise moult opérations nessussiennes par la suite.
- il fait moins de deux pages de code, parce qu'il s'appuie sur le noyau pour ouvrir des connexions TCP. Mais c'est un peu le boulot du noyau, non ?
- il n'est pas discret et c'est tant mieux.

Évidemment, il ne ressemble pas à un outil de hacker (non, je n'ai cité personne).
Tant mieux, ça m'évitera de prendre des coups de botin dans les bureaux de la DST.