To mitigate this, under Discovery in an Advanced Scan, turn off “Ping the remote host.” This will stop the scanning host from using ICMP to determine if a host is live, allowing the scan to continue. However, when used against an internal target set, this issue can arise from scanning a VMWare-based client. When using this against an external target list, the issue is usually caused by a CDN or another web-based target. These results can be caused by a firewall or content delivery network (CDN) accepting connections on all ports and then forwarding that traffic based on access control rules. Portsĭuring our scanning efforts against targeted hosts, we have seen Nessus report every port as open, usually when scanning a target list that is for a web application. Many of these issues have options in Nessus for quick configuration changes while the scan is running, allowing the user to fix potential issues on the fly. Legacy hardware, such as printers, can cause similar “denial of service” conditions. Network issues can be mitigated beforehand by communicating with the client on the network load of sensitive equipment, high priority hosts, and high availability hosts. Sensitive networks can become congested and give false positives, bad results, and have impact on production networks. These issues could be every port being open, or zero ports open on host that is known to be accessible. RedLegg has encountered several configurations that have caused issues with scans.
The GUI is the easiest place to configure the scan for a new user. This template allows for customization of the scan through the web GUI and allows the administrator control over aspects of the scan, including plugins and modules used, port listings, CRL checking, and many other options. RedLegg uses the Advanced Network Scan as a template for all scans. Once a target list has been provided, the administrator can configure scans using the Nessus web application, while more ‘under-the-hood’ adjustments can be made using a command line interface included in the software.
Data is then exported and parsed into a custom database that allows for quick analysis of potential vulnerabilities. RedLegg uses the data created by Nessus to examine a target’s network and make plans for intrusion. Used by security administrators, penetration testers, and network administrators to diagnose weaknesses and points of potential vulnerability, Nessus is a widely used platform for vulnerability scanning and assessment. We’ll talk about the issues we have encountered, indicators of these issues, and our resolutions. (These issues can be caused by a variety of configurations and deployments.) RedLegg has extensive experience in vulnerability scanning using the Nessus platform, and during our use of the software, we have discovered several scenarios that have caused issues with our scans. While Nessus is a widely common scanning platform, there are a few best practices to consider when completing your scan without error or oversight.
0 kommentar(er)
