Chapter 17 security scanners
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
In this chapter we will look at popular security scanners.
First let's copy the programs to the hard disk
will now compile and install the individual programs beginning with map
the compilation process can take a couple of minutes depending on the available hardware resources.
Finally we will install the program on the system using the root account for this purpose
as we can see and map has many options.
Let's familiarize ourselves with them using the manual available with the system
we will investigate the first option minus s t it determines the standard type of scanning using the
Kinect system function.
The next kind is half open scanning with the x y in packets.
In order to take advantage of this type of scanning we will use the minus s s option
the next method corresponds to scanning using the F-I in packets with different flags set depending
on the option chosen.
However we should remember that this kind of scanning can be ineffective for Windows systems.
The next paramita is minus SU which corresponds to scanning with the UDP protocol using I see empty
packets
also worth mentioning is the minus Espey option.
It determines if the scanning target is presently active.
By using the star sign we can scan the whole subnetwork
using the minus meter we can determine the exact service version working on a specific port.
The minus S is 0 paramita muter uses scanning with the IP protocol the scanner sends IP packets that
not have the header of another protocol and expects the answer
another paramita is minus as a.
It allows us to set the port filtering.
This technique uses the AC packets
the minus S-W option corresponds to the scanning technique with the window size of the TCAP packet.
It allows us to find the port filtering through a firewall.
The minus s l option serves to generate the list of host names or IP addresses without performing proper
scanning.
Now let's proceed with the installation and configuration of the next application.
Nessus
the program compilation can take some minutes.
So patience is required.
As we can see many compiler warnings are being generated.
However this does not influence the positive termination of the compilation.
Finally after Round 6 minutes of compilation The program is ready for use.
We still have to generate the certificates and the user
after terminating the configuration we start up the Nessus the server and wait for all the plug ins
to upload.
After logging in and accepting the certificate we have access to a series of plugins that we can use
during scanning.
We select only these plugins that will be useful during scanning.
This will significantly shorten the test execution time.
Finally we enter the name and IP address of the scanned computer and to find the scanning method.
After a moment the results of the test are available let's have a look at them
after familiarizing ourselves with the scanning results so we can save hours in a report.
And one of the many available formats.
Next program we will have a look at will be nikto.
So let's unpack the application
Nico's an extended scanner of the w w w server it allows over 3000 errors in the server configuration
and in PH.
In CGI files to be detected before proceeding with scanning it is a good idea to update the program
database.
We use the update paramita for this purpose.
The update can take several minutes depending on the capacity of the link we have at our disposal.
After having updated it we can proceed with testing the functioning of the program in practice.
As we can see the scanner has revealed many errors in the configuration of the software that works on
the w w w pages server.