RE: [Database-devel] questions...

I found the problem I am having... It looks like I am getting a SIGSEGV
error on line 802 of save_db.c when using nessuswx and not storing anything
in the knowledgebase or vulnerability tables. It worked fine with the
standard nessus client. The tables userlist and usersession are still not
being populated though.. I didn't find any code for this either.. Did I miss
something or has it not been implemented yet? 

One last question... There are a few tables in the perl script that are not
created with nessusd. Have they just not been implemented yet? Or are they
part of an old schema?

Thanks for all the help,

Jeff

-----Original Message-----
From: Marsh, Cory [mailto:[email protected]] 
Sent: Wednesday, January 14, 2004 1:43 PM
To: Jeff Dell; Javier Fernandez-Sanguino
Cc: [email protected]
Subject: RE: [Nessus-devel] [Database-devel] questions...

That's odd about the vulnerability table.  You can try this:

create a new database from scratch.  in the nessusd.conf file set the
option: 'db_make_tables = yes'.  This will tell nessus to create the tables
you need with the proper case (lowercase).  This may help you.  The code is
written such that failed SQL queries should generate log messages in
nessusd.messages (I think that's the log file).  So if the statements are
failing they should be listed there.  If you still are scanning and getting
vulnerabilities that are not showing up in the database, the only thing I
can think of is that the code is not being called.

nessusd/attack.c lines 512,513 should call db_update_host_scan() and
db_dump_kb() respectively.  You should be able to see the status in the
hostsession table set to "Finished" when this runs.  You should also see the
entire knowledgebase in the knowledgebase table.  The db_dump_kb() function
reads the knowledgebase for keys 'SentData/TYPE/' where TYPE can be any of
the set { 'NOTE', 'INFO', 'HOLE' } and inserts these knowledgebase values
into the vulnerability table.  db_dump_kb() also updates the service table
with open ports, and takes keys of the form 'Success/PLUGINID' and sets the
appropriate executedplugin status to 'Success';  If you see either of these
updated status messages in the db, you know the db_dump_kb() function is
running and you should see results in the vulnerability table.

A few other notes about db_dump_kb(), it currently replaces values for the
key 'SMB/password' to 8 stars '********' before inserting into the database.
Keys that begin with '/tmp' are not inserted.  db_dump_kb() also checks for
the keys 'HOST/name' and 'HOST/mac' and hard sets the host table to these
entries.  I use this feature to fill out the MAC address of windows systems
that are not on my broadcast domain by setting the knowledgebase key
'HOST/mac' to the MAC address returned in the plugin
'netbios_name_get.nasl'.  Everywhere you see 'set_kb_item(name:'SMB/name',
value:name);' add the line: 'set_kb_item(name:'HOST/name', value:name);'.
Also, right BEFORE you see the line: 'if(adapter_nbame == "0x00 0x00 0x00
0x00 0x00 ") {' (line 248 in my script), add the line:
'set_kb_item(name:'HOST/name', value:mac_address);'.  Adding these two
elements to the netbios_name_get.nasl script will ensure that the host table
reflects the computer name for the system, and the MAC address.  the
db_dump_kb() function also uses these values to determine if it has seen a
host before.  If the nessus server is unsure if the host it is scanning
exists in the host table or not, it will create a new host.  If any of the
plugins set the 'HOST/name' or 'HOST/mac' values, the db_dump_kb() function
that runs after the scan will search the host table to matching entries and
update the new host data to map to the existing host in the database.
Obviously the MAC address is treated as the ultimate determining factor if
two hosts are in fact the same.  This happens entirely automatically, but it
is a good idea to change to netbios_name_get.nasl script to help NESSUS_SQL
in determining exactly what host it is scanning.

Regards, Cory




_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel