Re: Enhancing Nessus FindServices (request for comments)

On Mon, Jan 27, 2003 at 05:38:09PM -0600, Erik Anderson wrote:
> 
> For our usage we are going to enhance Nessus’s service discovery
> capabilities and provide this work back to the Nessus community.
> 
> We need Nessus to extracted, determine, or guesstimate information
> about running remote services like service type, service version,
> protocol version, and vendor if possible.
> 
> Below are my findings on Nessus’s service detection capabilities,
> requests, and question.
> 
> Current FindServices capabilities:
> This group of services appear to have header based detection built
> into Nessus.  Is this list complete?
> chargen
[...]
> vtun
> time
> socks_proxy
> 
> Normal service detection based on ports only (Non-ssl ports)
> Port 4:     Echo
[..]

Please read the source code of the plugin first. This list is used to
tell the user what *normally* runs on this port.


> SSL service detection based ports only
[...]

Only if you asked the plugin to *NOT* automagically detect SSL services.




> First questions:
> 1) What is the sequence of events Nessus goes through from when NMAP
> returns an open port to the final XML/Text report output?

- Nmap stores the list of open ports in the KB
- find_services.nes is launched :
	- For each open port, it connects to it, and recognizes if
	  it's running SSL or not (except if asked not to do so, as 
	  SSL negociation sometimes crashes services)

	- It sends an HTTP request (it could be anything)

	- Then it reads the data in the socket buffer. This can include
	  the banner of the remote service, or the reply to the HTTP
	  request we sent

	- Based on the result, it attempts to determine which service is
	  running behind the port.

	- It stores that information in the KB

- dcetest.nasl and rpcinfo.nasl are launched
	-> They map which ports are running DCE/RPC services, and mark
	   them as 'known' in the KB

Then, in Nessus 1.3 :

- find_service2.nasl is launched
  	- It sends a HELP command to every port not yet recognized
	- It recognizes a couple of additional services

- unknown_services.nasl is launched last. It connects to every port
  not yet recognized and tells the user that Nessus did not find what
  was running on this port.

> 2) Do all open ports goes through a detection sequence?

Yes.

> 3) If NMAP returns a standard non-ssl port what does Nessus do to
> verify that generic port to service mapping?

See above.

> 4) If NMAP finds an oddball off-port running, what detection/connect
> sequences does Nessus run through to try and map back that open port
> to a known service?  Does it try and pull a header or send data
> requests to the port to map that data back to a known service?

Read the source code of the plugins mentionned above.


> 5) Does Nessus try and detect if ports are normal or SSL?

Yes.

> Below is a starter list of things we need.
> 1) Run all standard services through sequences to get/guess service
> versions
> 2) Run all standard services through sequences to try and get vendor
> information.
> 3) Run all oddball ports through a query/response sequence to try and
> determine if it is a normal or SSL port.
> 4) Run all oddball ports through a query/response sequence to try and
> determine if this is a standard service running on a custom port.
> 5) If no other information is available for an oddball port try and
> determine the communications delivery methods (XML, ODL, HTTP).


That's exactly what is being done.


> I see many times something to the effect:
[...]
> Is this adequate?  Should items like this be improved upon?  There
> should definitely be detection sequences to determine things like
> MSSQL Server, Oracle, Sybase, etc... running on off ports.

It's not adequate, but you selected a very particuliar case. Most
plugins do something like :

port = get_kb_item("Services/<servicename>");
if(!port)port = <servicedefautport>;


> Request for comments:
> I will be enhancing the FindService features to accomplish the above.

Thanks, but I think you're work will be pretty easy.


				-- Renaud