Printable View
I am doing a test on our servers at work. I have been using Nessus to do traditional vulnerability scans and my question is this:
I want to view the actual requests, in raw format that nessus makes when testing for vulnerabilities. Can the requests be found somewhere so that the actual requests can be viewed?
Thanks!
You should be able to look into the rules that make a nessus test. I can't tell you where they are but I'm sure it's in the documentation.
If you want to see the 'real' traffic (ip packets et al) why not hook up a sniffer? Ethereal wil do very well.
Well, it's a bit of a kluge, because I don't know how to do it in Nessus, or if it can be done even, but have you thought about putting something like ethereal downstream of your nessus server so you can examine the packets? I would think either creating a span port (if your switches will support that) or dropping the nessus server on an old hub that you having lying around and putting the ethereal machine on it, (the hub) would give you everything you wanted.
edit----damn, sir dice posted while I was typing. Yeah, what he said. :)
Or if using *nix you can fire up "ngrep" while nessus scanning your server, I've done it two month ago..you will see the real traffic too..
www.majorgeeks.com has a pile of exploit scanners and admin tools to help you in your quest.
in RH9 the test are in /usr/lib/nessus/plugins and are written in nasl
This will tell you about nasl http://www.nessus.org/doc/nasl2_reference.pdf and from that you should be able to work out whatthe tests are doing (& probably get them to dump input/otput) to files.
HTH
I am indeed using linux. That grep command sounds interesting. What did the command look like?
Most linux's have tcpdump or similar... or, at least, the RPMs are fairly accessible from your vendor/distro.
We've had to do this in the past as well. Like 4 or 5 people already said. The "best" way would be a sniffer. Any sniffer will do, just write the output to a file then go back and look at all the traffic. This is good way to prove you ran certian tests, and did not run others (Some clients don't want you running certian tests).
"grep" and "ngrep" they are differents:Quote:
Originally posted here by Surreal
I am indeed using linux. That grep command sounds interesting. What did the command look like?
Code:NAME
grep, egrep, fgrep, zgrep, zegrep, zfgrep, bzgrep, bzegrep, bzfgrep -
print lines matching a pattern
SYNOPSIS
grep [options] PATTERN [FILE...]
grep [options] [-e PATTERN | -f FILE] [FILE...]
DESCRIPTION
grep searches the named input FILEs (or standard input if no files are
named, or the file name - is given) for lines containing a match to the
given PATTERN. By default, grep prints the matching lines.
In addition, two variant programs egrep and fgrep are available. egrep
is the same as grep -E. fgrep is the same as grep -F. zgrep is the
same as grep -Z. zegrep is the same as grep -EZ. zfgrep is the same
as grep -FZ.
etc
So you need to have "ngrep" install on your box and read the manual first..for ngrep and you will know what the command is.. :)Code:SYNOPSIS
ngrep <-hXViwqpevxlDtT> <-IO pcap_dump > < -n num > < -d dev > < -A num
> < -s snaplen > < match expression > < bpf filter >
DESCRIPTION
ngrep strives to provide most of GNU grep's common features, applying
them to the network layer. ngrep is a pcap-aware tool that will allow
you to specify extended regular expressions to match against data pay-
loads of packets. It currently recognizes TCP, UDP and ICMP across
Ethernet, PPP, SLIP, FDDI and null interfaces, and understands bpf fil-
ter logic in the same fashion as more common packet sniffing tools,
such as tcpdump(8) and snoop(1).
etc