Re: Enhancing Nessus FindServices (request for comments)

Erik Anderson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> For our usage we are going to enhance Nessus’s service discovery
> capabilities and provide this work back to the Nessus community.

That's great, Renaud already answered most of the questions so I'm going 
  to pinpoint only some stuff.

> 
> I see many times something to the effect:
> if (get_port_state(1433))
> {
>  soctcp1433 = open_sock_tcp(1433);
> 
>  if (soctcp1433)
>  {
>   data = "It is possible that Microsoft's SQL Server is installed on
> the remote computer.";
>   security_warning(port:1433, data:data);
>  }
> }
> 
> Is this adequate?  Should items like this be improved upon?  There
> should definitely be detection sequences to determine things like
> MSSQL Server, Oracle, Sybase, etc... running on off ports.

As Reanaud said, this is not adequate. You can consider submitting a bug 
report (to bugs.nessus.org) for this plugin asking it to be modified (it 
should use the KB, should it not?)

>  Request for comments:
> I will be enhancing the FindService features to accomplish the above.
>  We will be giving these enhancements back to the Nessus community.

That's great as I've said.

> First we would like to see responses to the below questions:
> 1) What should be done to improve the existing features?

If you check the findservices plugin you will see it provides a nice 
generic framework for service discovery. It might be lacking some 
popular services but they could be easily coded in. In this respect, I 
think 'amap' (a Nessus user pointed it a while back) could be useful. 
Check Bug #59 (http://bugs.nessus.org/show_bug.cgi?id=59). I list in the 
bug report a number of services that seem to be detected by amap and are 
not detected by findservices.

Taking amap's fingerprint for the service and putting it into 
findservices should be an easy task.


> 2) What new features should be added to improve the feature set?

I believe adding more services to the ones available is a must. 
Specially popular services such as ms-sql, oracle's listeners and LDAP.

> 3) What would people like to see as far as service detection
> capabilities go?

More service detection + more information on the given service and 
issues. For example, if a remote server has 'netstat' I want to be able 
to view (in reports) both the availability of the service and a dump of 
the current open ports (which could be added to the KB).

> 4) How much of this information should be reported back in the Nessus
> report?  (FYI: We need all information the server gleamed returned
> back to the client to be provided in the Nessus XML report)

I belive all information should be sent back, we might probably need to 
add, later on, a way for users to remove deep-technical info from 
reports but from the time being all information is useful-

> 
> Please provide feedback/recommendations so I can develop a list of
> requirements to provide management and get to the real coding work.
> 
> ThanX in advance
> 
> Erik

	Thank you for your work. Hope my suggestions were useful.

	Regards

	Javi