Nessus

Who, What, Why piis8@yahoo.com Tenable Nessus 4.2.x Seccubus Inprotect isac “piss” Tenable Nessus 4.2.x Seccubus Inprotect Improving the use of the tools Lots of new features and changes **Some statements contained herein are my own poorly validated conclusions and may be utter rubbish. http://gophermash.blogspot.com/

Objective Nessus Seccubus Inprotect Data Quick overview Version 4.x , What is new Seccubus Why Bulk scanning Inprotect Data The bane of my existance Nessus http://www.nessus.org/nessus/ License Agreement http://cgi.tenablesecurity.com/Nessus_4_SLA_and_Subscription_Agreement.pdf Seccubus http://seccubus.com/ Inprotect http://inprotect.sourceforge.net/ Data http://lmgtfy.com/?q=parse+nessus+output

Nessus The Nessus® vulnerability scanner is the world-leader in active scanners, featuring high-speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of your security posture. Nessus scanners can be distributed throughout an entire enterprise, inside DMZs and across physically separate networks. -- Tenable In computer security, Nessus is a proprietary comprehensive vulnerability scanning program. It is free of charge for personal use in a non-enterprise environment. Its goal is to detect potential vulnerabilities on the tested systems. --wilipedia Nessus http://www.nessus.org/nessus/ License Agreement http://cgi.tenablesecurity.com/Nessus_4_SLA_and_Subscription_Agreement.pdf

Nessus Apr 04 1998 first alpha version released on bugtraq May 17 2000 1.0.0 released Feb 24 2003 2.0.0 released Dec 07 2004 2.2.1 released Foreshadowing of a future Jan 1 2005 Feed Model Changes Dec 12 2005 3.0.0 released Closed Source, proprietary license Oct 30 2006 2.2.9 released Last open source build Announcements Website http://www.nessus.org/news/ Discussions Announcements Site https://discussions.nessus.org/community/announcements

Nessus Mar 12 2008 3.2 released Jul 31 2008 Feed Model Changes Registered / Direct  Home/Professional Feb 16 2009 Mail Lists Disabled Web based ‘Discussion Forums’ / nessus-announce stays Apr 09 2009 4.0.0 released Nov 30 2010 4.2.0 released Web based interface Apr 15 2010 4.2.2 released http://marc.info/?l=nessus-announce&m=123178018626097&w=2

Shiny Web Interface, no more stand-alone client Flash / XMLRPC communications Keep a copy of the 4.0.2 client Web Interface is still unique to each scan engine NTP 1241 disabled for Home Feed Other limitations on Home Feed, ie. 15 max hosts NTP 1241 enabled for Professional Feed …but for how long? Shared Policies New xml output format, .nessus v2 Still no easy way to share reports

Flash Why, Why, Why, Why Renaud states <insert paranoia here> Renaud states “In the (not-so-distant) future, yes, HTML5 will probably be the way to go and our backend is ready for that.” … “However, today, we use Flash because it's the most efficient technology to take us where we need to be.” Adobe Flash Decompilers Why Flash https://discussions.nessus.org/message/5128;jsessionid=E5939693AD30F482214D55378ED72027 Decompile http://code.google.com/p/flash-decompiler/ General Adobe bashing http://www.zdnet.com/blog/bott/how-secure-is-flash-heres-what-adobe-wont-tell-you/2152 Symantec Threat Report http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_internet_security_threat_report_xv_04-2010.en-us.pdf Adobe Security http://www.adobe.com/security/ http://www.adobe.com/devnet/flashplayer/articles/flash_player_10_security.pdf http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf http://www.adobe.com/devnet/flashplayer/articles/flash_player_8_security.pdf http://www.adobe.com/devnet/flashplayer/articles/flash_player_7_security.pdf

XMLRPC ??? Future scripting / integration with 3rd party tools? It's remote procedure calling using HTTP as the transport and XML as the encoding. XML-RPC is designed to be as simple as possible, while allowing complex data structures to be transmitted, processed and returned. -- xmlrpc.com Future scripting / integration with 3rd party tools? libs available for perl / ruby / C / .net / php / etc. 3rd party catch-up Kost on Freshmeat Net::Nessus::XMLRPC (perl) nessus-xmlrpc (ruby) Port 1241 ? http://blog.upbeat.fr/post/407107943/automating-scans-on-nessus-4-2 https://discussions.nessus.org/message/5995;jsessionid=23B68091A3049FACAB6B85A85598B32A http://www.tumblr.com/tagged/Nessus+4.2 http://freshmeat.net/projects/nessus-xmlrpc http://freshmeat.net/projects/netnessusxmlrpc

Home vs. Professional Home Free Max 15 hosts (simultaneous) No Credential Scanning No Compliance checks No SCADA checks No NTP / port 1241 Professional $1200 / year Unlimited hosts Credential Scanning Compliance Checks SCADA checks NTP /port 1241 support Kost on Freshmeat

Compliance (ProFeed only) As of May 4th , 68 audit files. Windows best practices *nix (linux, bsd, solaris, hpux) best pratices Antivirus Confidential data PCI / Banking data SSN Copyright / P2P Govt Keywords And more Bypass Home https://discussions.nessus.org/message/4152#4152 4.0.2 on new linux cp libssl.so.0.9.8n /usr/lib/. ln –s /libssl.so.0.9.8n /usr/lib/libssl.so.8 cp libcrypto.so.0.9.8n /usr/lib/. ln –s /libcrypto.so.0.9.8n /usr/lib/libcrypto.so.8

Hacks Bypass Home restrictions (unconfirmed) Did not get this to work. Seems like it works as long as you are offline. Shared Reports (scriptable) Drop reports to local user space 4.0.2 on new linux Tenable only gives you an .rpm ( Fedora - libssl / libcrypto dependency) Copy old .0.9.8n and symlink it to .8 Bypass Home Feed Does not appear to work, definitely don’t let the server talk to nessus.org https://discussions.nessus.org/message/4152#4152 4.0.2 on new linux cp libssl.so.0.9.8n /usr/lib/. ln –s /libssl.so.0.9.8n /usr/lib/libssl.so.8 cp libcrypto.so.0.9.8n /usr/lib/. ln –s /libcrypto.so.0.9.8n /usr/lib/libcrypto.so.8

Hacks Report Sharing Files have “cryptic” names Files stored in /opt/nessus/var/nessus/users/<username>/reports 5ef4e929-8263-99ac-8ef1-78e85fe6d0165b65e004c8e3ead4 5ef4e929-8263-99ac-8ef1-78e85fe6d0165b65e004c8e3ead4.name 5ef4e929-8263-99ac-8ef1-78e85fe6d0165b65e004c8e3ead4.nessus 5ef4e929-8263-99ac-8ef1-78e85fe6d0165b65e004c8e3ead4.nessus.v1 Script a cp job to move files to alternate user space Bypass Home https://discussions.nessus.org/message/4152#4152 4.0.2 on new linux cp libssl.so.0.9.8n /usr/lib/. ln –s /libssl.so.0.9.8n /usr/lib/libssl.so.8 cp libcrypto.so.0.9.8n /usr/lib/. ln –s /libcrypto.so.0.9.8n /usr/lib/libcrypto.so.8

Lightweight web based front end, perl and php with a flat file db http://seccubus.com/ written by Frank Breedijk, Security Engineer at Schuberg Philis Lightweight web based front end, perl and php with a flat file db User authentication is dependent on the web server Good for a small team does not scale well to a large user base http://seccubus.com/

scanmonitor.pl Not a fan of cron Not a fan of “empty” scans Needed a more flexible scheduler scanmonitor.pl allows for a continuous scan loop of the entire enterprise with minimal empty cycles between scan jobs initial scans 60K IPs in 16 hours on 4 scan engines **Can quickly eat hard drive space and memory http://gophermash.blogspot.com/

mrtg / resources

mrtg / resources

Inprotect http://inprotect.sourceforge.net/ written by Greg Kuhnert and team Web based front end, perl and php with a sql db Nice system, should scale nicely to a large user base Installation is improving but still a bit rough http://inprotect.sourceforge.net

DATA DATA DATA

What’s next Automated parsing of critical findings Trend exposure time Compare known postures

Demo

‘The Making of Horror’ Joshua Hoffine