Re: dns_fingerprint.nasl - silent exit after 3 timeouts [patch]

On Tue, Jul 20, 2004 at 01:49:25PM -0400, Renaud Deraison wrote:

> On Tue, Jul 20, 2004 at 04:57:11PM +0200, Martin Ma?ok wrote:
> > I have come across some DNS server (probably LAN Suite 602 on Windows server,
> > but who knows...) that was not fingerprinted by Nessus, nor it was a message in
> > the report that it couldn't be fingerprinted etc.

> > 1:t:t:t:t:t:t:t:0X:0X:t:0X:15X:0Z0X:0X:0X:t:t:t:0X:0X:4:t:

> It should, but in your case you end up with a plugin with takes
> nearly one minute to be executed, for a result that is not really
> used in the rest of the scan. 

It is 20 seconds with no result versus 70 seconds with some result.

> So this plugin is a perfect example of a speed vs. accuracy conflict
> we often hit.

Is this acceptable?

--- dns_fingerprint.nasl.orig   2004-07-22 11:31:54.000000000 +0200
+++ dns_fingerprint.nasl        2004-07-23 10:38:19.000000000 +0200
@@ -44,6 +44,7 @@


 include("misc_func.inc");
+include("global_settings.inc");

 id = rand() % 1024;
 TIMEOUT = 5;
@@ -59,7 +60,22 @@
  send(socket:soc, data:message);
  r = recv(socket:soc, length:4096);
  close(soc);
- if ( ! r ) { timeouts ++; if (timeouts > 3) exit(0);  return "t:";}
+
+ if ( ! r )
+ {
+   timeouts ++;
+   if (timeouts > 3 && ! thorough_tests)
+   {
+     if (report_verbosity < 2) exit(0);
+     else
+     {
+       report = "Name server could not be fingerprinted (too many timeouts)";
+       security_note(port:53, proto:"udp", data:report);
+       exit(0);
+     }
+   }
+   return "t:";
+ }


  rcode = substr(r, 3, 3);



Martin Mačok
IT Security Consultant
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel