Doing More with Less: Nessus
One of the most interesting things that I have noticed over the years is the amount of information security tools that require some serious dollars to be invested. I believe it is time to rediscover an Open Source vulnerability assessment tool that has been around for quite some time and should not put a serious whole in your wallet.
|
|
Nessus Primer with the NessusWX Client
A simple installation of the Nessus server from sources onto a test machine running FreeBSD 4.9 will be conducted. The client portion of Nessus will be installed onto a Windows XP machine. Although it will be impossible in the brevity of this assignment to cover all aspects of Nessus, test scans will be run on a few varying systems running Windows and FreeBSD operating systems.
|
|
Pocket Nessus
The purpose of this paper is to introduce a particular set of tools that I've found work well for my applications. I, too, recommend Nessus along with another useful tool "the White Glove CD" which contains many other applications that can be used to secure your network. In the end, you will find that you have an extremely portable toolbox that fits in your pocket and runs an open source vulnerability scanner recommended by networking organizations, SANS instructors, and used by many commercial companies. This paper will provide a brief introduction to Nessus and the White Glove CD.
|
|
Nessus Report Generating Tools
I wrote two scripts to help parse through nessus results from a penetration test or vulnerability assessment. The first is to convert a nbe file to an sqlite database called nbe2sql. The second script takes the sqlite database and outputs all IPs with TCP and UDP ports open, in a csv format to help on report generation. The next piece I want to write is a gui frontend to help explore and verify results from the nessus scan. Some features planned are grouping of results by IP, vulnerability, or port. Analyst notes would be entered directly into the application, which would also help on report generation.
|
|
Installing and Configuring Nessus
Every time a security advisory goes public, organizations that use the affected software must rush to install vendor-issued patches before their networks are compromised. The ease of finding exploits on the Internet today has enabled a casual user with little skills to launch attacks and compromise the networks of major corporations. It is therefore vital for anyone who has any hosts connected to the Internet to perform routine audits to detect unpatched remote vulnerabilities.
|
|
Using Nessus to detect Wireless Access Points
This paper will discuss the techniques used by Nessus to efficiently scan for wireless access points. It will also highlight some of the advantages and disadvantages of scanning with Nessus as compared to manual physical audits. Recommendations for writing signatures to detect new types of WAPs will also be covered.
|
|
Nessus Plugins
The Open Source Nessus scanner supports a plugin architecture that allows anyone to develop security checks in the NASL (Nessus Attack Scripting Language) language. We have contributed the plugins below to the Nessus effort. Because the administrator of Nessus, or others, may modify the source for multiple language support, bugfixes, etc., these files are linked directly to the CVS server on nessus.org.
|
|
Introduction to Nessus Tutorial
Nessus is public domain software released under the GPL. Nessus is designed to automate the testing and discovery of known security problems. Allowing system administrators to correct problems before they are exploited. Historically, many in the corporate world have frowned on such public domain software, instead choosing "supported" products developed by established companies. Usually these packages cost thousands of dollars and the license is based upon the number of IP addresses scanned. However, many in the corporate world are now starting to realize that public domain software, such as Nessus, NMap, Apache, and MySQL, is often superior to similiar comercial products.
|
|
Actions
Category Stats