RE: [Database-devel] questions...

That's odd about the vulnerability table.  You can try this:

create a new database from scratch.  in the nessusd.conf file set the option: 'db_make_tables = yes'.  This will tell nessus to create the tables you need with the proper case (lowercase).  This may help you.  The code is written such that failed SQL queries should generate log messages in nessusd.messages (I think that's the log file).  So if the statements are failing they should be listed there.  If you still are scanning and getting vulnerabilities that are not showing up in the database, the only thing I can think of is that the code is not being called.

nessusd/attack.c lines 512,513 should call db_update_host_scan() and db_dump_kb() respectively.  You should be able to see the status in the hostsession table set to "Finished" when this runs.  You should also see the entire knowledgebase in the knowledgebase table.  The db_dump_kb() function reads the knowledgebase for keys 'SentData/TYPE/' where TYPE can be any of the set { 'NOTE', 'INFO', 'HOLE' } and inserts these knowledgebase values into the vulnerability table.  db_dump_kb() also updates the service table with open ports, and takes keys of the form 'Success/PLUGINID' and sets the appropriate executedplugin status to 'Success';  If you see either of these updated status messages in the db, you know the db_dump_kb() function is running and you should see results in the vulnerability table.

A few other notes about db_dump_kb(), it currently replaces values for the key 'SMB/password' to 8 stars '********' before inserting into the database.  Keys that begin with '/tmp' are not inserted.  db_dump_kb() also checks for the keys 'HOST/name' and 'HOST/mac' and hard sets the host table to these entries.  I use this feature to fill out the MAC address of windows systems that are not on my broadcast domain by setting the knowledgebase key 'HOST/mac' to the MAC address returned in the plugin 'netbios_name_get.nasl'.  Everywhere you see 'set_kb_item(name:'SMB/name', value:name);' add the line: 'set_kb_item(name:'HOST/name', value:name);'.  Also, right BEFORE you see the line: 'if(adapter_nbame == "0x00 0x00 0x00 0x00 0x00 ") {' (line 248 in my script), add the line: 'set_kb_item(name:'HOST/name', value:mac_address);'.  Adding these two elements to the netbios_name_get.nasl script will ensure that the host table reflects the computer name for the system, and the MAC address.  the db_dump_kb() function also uses these values to determine if it has seen a host before.  If the nessus server is unsure if the host it is scanning exists in the host table or not, it will create a new host.  If any of the plugins set the 'HOST/name' or 'HOST/mac' values, the db_dump_kb() function that runs after the scan will search the host table to matching entries and update the new host data to map to the existing host in the database.  Obviously the MAC address is treated as the ultimate determining factor if two hosts are in fact the same.  This happens entirely automatically, but it is a good idea to change to netbios_name_get.nasl script to help NESSUS_SQL in determining exactly what host it is scanning.

Regards, Cory

-----Original Message-----
From: Jeff Dell [mailto:[email protected]]
Sent: Wednesday, January 14, 2004 10:35 AM
To: Marsh, Cory; 'Javier Fernandez-Sanguino'
Cc: [email protected]
Subject: RE: [Nessus-devel] [Database-devel] questions...


Thanks for all the info... With some minor tweaking, I was able to get
almost everything to work. From looking at the source, It looks like the
table DETECTEDVULNERABILITY that was created with the nessus_db_schema.mysql
should be really called vulnerability. I added this table and changed all of
the other table names to lowercase, but DETECTEDVULNERABILITY or
vulnerability are still not getting populated. It looks like most of the
other tables are getting populated though. I checked the nessusd.dump and
nessusd.messages and I am not getting any errors or messages regarding this
problem (I did get messages when I had uppercase tables names). Does anyone
have any hits?

Thanks,
Jeff


-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Marsh, Cory
Sent: Tuesday, January 13, 2004 5:47 PM
To: Javier Fernandez-Sanguino
Cc: [email protected]
Subject: RE: [Nessus-devel] [Database-devel] questions...

1. I would not recommend using the import-nbe.pl script.  The NESSUS_SQL
code captures a lot of state information (such as knowledgebase, execution
time, status, etc)  This information is not captured in the nbe output.
Going this route will lead to incomplete data.  I also believe that the
import-nbe.pl scripts do not work with the NESSUS_SQL code as is.

With regard to #2, the db_compress feature is not currently supported.

With regard to #3, I have an updated version of nessus-extract.pl that works
with the code in NESSUS_SQL.  I have also updated some of the regular
expressions to be more robust and case insensitive.

On a more general note, the tables have been renamed to all lowercase (it is
quite a pain to type uppercase column names in the SQL command line)

I also have a Perl script that generates a lot of different reports from the
database.  These include standard reports (similar to nessus html save),
executive summary reports, flat text files and Excel spread sheets (thanks
to Spreadsheet::WriteExcel).  The Perl reporting code also  auto remediates.
This means that if an issue was detected on scan #1 and then checked for but
not found on scan #6, this issue will be included in the report as fixed.
This is a time consuming feature but quite worthwhile.

I also have updated SQL code with speed improvements and support for auto
magically creating inno db tables for MySQL.  Postgre support should be soon
now.

I will try and get the new code to Javier some time in the next week.

-Cory


_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel


This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. A1.


_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel