1. Vulnerability Scanning Michael Overton, Jason Ferris, Erik Brown

2. Scanners Used Nessus ◦ Covered the most CVEs, but missed some things SARA ◦ Only gave a subset of Nessus’ results X-Scan ◦ Also only a subset of Nessus’ results ISS ◦ Not particularly useful (though only the trial) Retina ◦ Gave a lot of results ◦ Little intersection with the others

3. Network Scanned Small private network Benefits: ◦ Feasible to use trial version software ◦ Viable simulation of larger network running several machines using the same hard disk image Issues: ◦ Hard to gather statistically significant data

4. Reporting Methodology Compilation of scan results done by hand ◦ No team members particularly skilled in a viable scripting language ◦ Small number of reports made hand compilation more feasible, but it became quickly apparent that this method would not scale well Sorted final results both by majority voting and severity rating

5. Majority Voting Compiled the list of CVEs found by each scanner Re-ordered the report to indicate which CVEs were reported by the most number of scanners Top Five: CVERetinaNessusX-ScanSARAISS CVE-1999-0505xxxx CVE-1999-0519xxxx CVE-2000-1200xxxx CVE-1999-0504xx CVE-1999-0524xx

6. Severity Rating Cross correlated CVEs with CVSS base score Nessus and Retina covered the top five predominately Top Five: CVE CVSS Base ScoreRetinaNessusX-ScanSARAISS CVE-2000-022210xx CVE-1999-053510x CVE-2004-109410x CVE-2005-359510x CVE-2007-244610x

7. Metasploit Because of the small size of the network, the number of possible exploits were limited Many required user interaction or previously established host access Setup, but did not utilize a Samba exploit

8. Conclusions Nessus and Retina seemed to be the best of the ones we used Many scanners seemed to focus on detecting vulnerabilities specifically not detected by other scanners, requiring the use of many scanners to detect most vulnerabilities Many frivolous “vulnerabilities” detected, making it difficult to get useful results