Re: OS Identification (Plugin 11936)
Ron Gula <[email protected]>
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Message-ID | <[email protected]> |
Ray Van Dolson wrote: > On Fri, Jul 18, 2008 at 08:15:22AM -0700, Ray Van Dolson wrote: >> Hi all, per this blog: >> >> http://blog.tenablesecurity.com/nessus/page/3/ (search down the page >> for 11936) >> >> The listed plugins are used to determine the identify of the OS on the >> target host. I don't see output of telnet listed there -- would this >> be ignored as a factor in determining the OS? In other words: >> >> $ telnet hostname >> Trying 10.27.52.76... >> Connected to hostname. >> Escape character is '^]'. >> Red Hat Enterprise Linux Server release 5.2 (Tikanga) >> Kernel 2.6.18-92.1.6.el5 on an x86_64 >> login: >> telnet> quit >> >> It seems that this could be used with a high degree of confidence in >> determining that this machine is a RHEL 5.2 machine :) Instead, with >> the above host and 11936 enabled, I get only a 30% chance that the >> machine is running the "Linux kernel". >> >> Anyone know on the telnet thing? > > I've modified the os_fingerprint_telnet.nasl plugin to do Linux > detection based on the telnet banner. > > What's the best way to get my changes submitted to Tenable for > inclusion in future releases of this plugin? > > Guess I'll start by opening a ticket, but maybe someone here can point > me in the right direction. As the blog entry said, please email [email protected]. We get many submissions on various OS ID entries and they are updated very frequently. Ron Gula Tenable Network Security _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus