RE: Windows File Contents Check Question.
"Mehul Revankar" <[email protected]> Fri, 6 Feb 2009 08:54:01 -0500
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Organization | Tenable Network Security, Inc. |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1342986636==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_01C98838.74C4CB10"
This is a multi-part message in MIME format.
------=_NextPart_000_0000_01C98838.74C4CB10
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Zate,
The file content NASL should be able to scan files that are locally attached
to the system.
Couple of questions :
- Are there are files on P$ that contain sensitive content?
- Could you add verbose tag within the check and see what files are
returned?
for e.g. you could do :
<item>
type: FILE_CONTENT_CHECK
verbose
description: "The file contains an Arizona Drivers license number"
file_extension: "txt" |"doc" |"xls" |"pdf"
regex: "([^0-9]|^)(([A-Z][0-9]{8}))([^0-9\-]|$)"
expect: "License" | "Driver" | "ID" | "Arizona" | "AZ"
max_size : "50K"
</item>
Also, if you are professional feed customer, I had recommend opening a
ticket with Tenable support regarding this issue.
- Mehul
_____
From: [email protected] [mailto:[email protected]]
On Behalf Of Zate Berg
Sent: Thursday, February 05, 2009 3:06 PM
To: nessus
Subject: Windows File Contents Check Question.
Does this only check C$?
I have a box with a P$ and windows filecheck on this completes almost
immediately as everything [PASSED]
Credentials are fine, what else could cause the checks to complete almost
immediately.
I've run using both the client and the nasl from the command line.
Anyway to get more of an idea on what it happening here ? WMI issue perhaps
?
Zate
------=_NextPart_000_0000_01C98838.74C4CB10
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.6000.16788" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>Zate,</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>The file content NASL should be able to scan files =
that are=20
locally attached to the system. </FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><SPAN=20
class=3D222245313-06022009><FONT face=3D"Courier New" size=3D2>Couple of =
questions=20
:</FONT></SPAN></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>- Are there are files on P$ that contain sensitive=20
content?</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>- Could you add verbose tag within the check and see what files =
are=20
returned?</FONT></SPAN></DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2></FONT></SPAN> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>for e.g. you could do :</FONT></SPAN></DIV><SPAN=20
class=3D041284613-06022009>
<DIV dir=3Dltr =
align=3Dleft><PRE><item><BR> &nb=
sp; type: =
FILE_CONTENT_CHECK<BR> =
verbose <BR> =
description: "The file contains an Arizona Drivers license =
number"<BR> file_extension: =
"txt" |"doc" |"xls" |"pdf" =
<BR> regex: =
"([^0-9]|^)(([A-Z][0-9]{8}))([^0-9\-]|$)"<BR> &nbs=
p; expect: "License" | "Driver" | "ID" | "Arizona" | =
"AZ"<BR> max_size : =
"50K"<BR> </item></PRE></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3D"Courier New" size=3D2>Also, if =
you=20
are professional feed customer, I had recommend opening a ticket =
with=20
Tenable support regarding this issue.</FONT></DIV>
<DIV dir=3Dltr align=3Dleft><FONT face=3D"Courier New" =
size=3D2></FONT> </DIV>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D041284613-06022009><FONT =
face=3D"Courier New"=20
size=3D2>- Mehul</FONT></SPAN> </SPAN></DIV></DIV><BR>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px =
solid; MARGIN-RIGHT: 0px">
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
<FONT face=3DTahoma size=3D2><B>From:</B> =
[email protected]=20
[mailto:[email protected]] <B>On Behalf Of </B>Zate=20
Berg<BR><B>Sent:</B> Thursday, February 05, 2009 3:06 PM<BR><B>To:</B> =
nessus<BR><B>Subject:</B> Windows File Contents Check=20
Question.<BR></FONT><BR></DIV>
<DIV></DIV>Does this only check C$?<BR><BR>I have a box with a P$ and =
windows=20
filecheck on this completes almost immediately as everything=20
[PASSED]<BR><BR>Credentials are fine, what else could cause the checks =
to=20
complete almost immediately.<BR><BR>I've run using both the client and =
the=20
nasl from the command line.<BR><BR>Anyway to get more of an idea on =
what it=20
happening here ? WMI issue perhaps ?<BR><BR=20
clear=3Dall>Zate<BR></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_0000_01C98838.74C4CB10--
--===============1342986636==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
--===============1342986636==--