Printable View
I am looking for a network security scanning software much like Retina (What I use now) to replace it. The company doesn't want to pay for it next year. So the verdict is .... no money, find something that does the same thing, and is free. I know there are some Unix tools out there, but I'm not much of a unix person so I need something that runs on windows and will pretty much the same thing Retina will. Any Ideas?
My first peice of advice is completely free:
1. Scan the network by hand. Even if you port scan everything first run by hand checks.
Of course, for automation here's a brief list of free software for your purposes (Granted, none of them are going to be an all-in-one, so mix them as needed to get the same benefit of retina:
packet sniffer: http://www.ethereal.com/
CGI scanner: http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2
General Information gathering: http://www.samspade.org/ssw/
Port scanner: http://www.insecure.org OR http://www.foundstone.com/index.htm?.../superscan.htm
Thats the limit of automation tools I know for Windows that would suit your current needs the best, merely because it's easier in my eyes to do it by hand. However, if at all possible, having one workstation specifically setup to run these network tests would increase the amount of comprehensive scanning tools by a LOT.
There are more then a few alternatives out there but two quite good alternatives I would recomend in addition to 'poohsuntzu' suggestions are Nessus and NeWT.
Signed ~Micael
I would also say Nessus, but I wonder how long it will stay completely free? They are already charging for getting plugin updates, before anyone else! I know the people at nessus are fed up with people making money off their back!
SittingDuck
I am developing a security scanner that runs on windows operating system.Its functions are as follows:
1)port scanning
2)OS detection
3)CGI and PHP based bugs checking
3)FTP bugs checking
4)SMTP based bugs checking
I am including vulnerabilities specific to IIS 4.0/5.0/6.0 APACHE,OpenBSD too.It is basically My school project i will complete its initial working code in next 45 days and i will surely post that initial code on antionline(if not the full versions code).It is going to be developed in vc++.
If you don't want to pay for any security scanner you can develop your own.It is not that difficult
you can get unix based security scanners code from packetstormsecurity analyse them.
You will get a list of files which are vulnerabile.use that information to make your own security scanner it won't take more then 2 months.If you develop it for personal use you don't have to provide features like multithreading and special looks to ur windows.
Or you can contact me 4 months later for a exe of my security scanner.....Stick to antionline iwill post that final exe on antionline if possible.
Is there a way one might talk you into writing a tut on that? :DQuote:
1. Scan the network by hand. Even if you port scan everything first run by hand checks.
For Windows or Linux? Either way, I'll consider it :)Quote:
Is there a way one might talk you into writing a tut on that?
It looks highly impractical.How about port scanning what you plan to do?go on and try to connect to each and every port individually?Quote:
Originally posted here by poohsuntzu
My first peice of advice is completely free:
1. Scan the network by hand. Even if you port scan everything first run by hand checks.
what about scanning a system for recently discovered jpeg vulnerability for which microsoft has released a scanner in octomber?
what about trying to find whether a perticular cgi vulnerability exist or not?how you plan to do that?
here is my guess:
1) try to find all default locations for that file(on different server and sometimes on same server)
2)craft a http request for all those default locations send them monitor response and see how it goes right?
what about OS detection?Ok i won't argue about that there are ways to do that.
3)what about webserver specific vulnerability like Webdav how you plan to detect that?
Plz correct me if i am wrong there is surely ways of doing these things by hand but all those mathod are highly impractical and time consuming.....IMHO
I do not know how many network scanners there are available that you are looking for that will satisfy your needs, especially when you are looking for a free version. There is GFI LANguard Network Security Scanner which I have used before and was pretty happy with it. There is a 30 day trial version which you can download for free that becomes a limited freeware version after the trial period. The good thing I liked about it was that it was a full version for 30 days. I used it for about a week and realized it was a bit much for me to play with for just the 5 PC's I have at home. Since I do not work with a actual network of 10 to hundreds of PC's I did not see the use of me using it much. But it is a nice product to use though. Don't take my word on it though, my word is just a opinion and it varies from each individual. ;)
The key to any sort of information security is to first understand the tools you are using, and how they work. What good is a port scanner if you've never at least once done a computer by hand on the most commonly used ports? Anyways, I was referring moreso to doing each method by hand than using a single automated solution. For port scanning I do a use of nmap to first collect the possible vunerabilites my network has. Now, because there is margin of error when port scanning (false positives on open ports) I go in by hand and check the ports it says is open.Quote:
It looks highly impractical.How about port scanning what you plan to do?go on and try to connect to each and every port individually?
I wouldn't want it any other way. When you have your job on the line, you don't half trust tools, you double check the results of those tools by hand.
That's great. Sadly, yet again scanning is something that can already be done manually. And again, I was referring to an all in one solution versus singluar tools that you can compare results with. I would still run that singular jpeg scanner, and not only verify that the results were accurate, but run a by-hand scan to catch anything they missed.Quote:
what about scanning a system for recently discovered jpeg vulnerability for which microsoft has released a scanner in octomber?
I would write a CGI file to test it against that vulnerability against said input. This is why programming is so important, and a fact I think you are missing. Those automated tools are doing nothing different nor special that a single person can't do by hand. Be it through a manual telnet, a quick CGI file, or manual packet injection/manipulation. The reason why those scanners can exist automagically IS because it can already be done by hand. That's just logic.Quote:
what about trying to find whether a perticular cgi vulnerability exist or not?how you plan to do that?
That's something you should have learned in "how to secure a network 101". I don't care what adaware finds or doesn't find, I'm still going to check my system manually in the common locations that may have slipped by the scanner.Quote:
1) try to find all default locations for that file(on different server and sometimes on same server)
Correct. Jotting down results.Quote:
2)craft a http request for all those default locations send them monitor response and see how it goes right?
Okay, it may just be me. But I'm seeing this from a greyhat "I was hired to secure the company's network" rather than "I am hacking because it's cool and they don't know about it". So in my case, the easiest way for me to find out what the operating system is running.. is to ask them. In your case, well... we won't get into grey hat tactics but NMAP's OS detector is a redflag giveaway to most firewalls and IDSes.Quote:
what about OS detection?Ok i won't argue about that there are ways to do that.
The exact same way the scanner detects it automagically. By hand. Be it a small C program, be it checking version number update release.Quote:
3)what about webserver specific vulnerability like Webdav how you plan to detect that?
Sure, it takes a bit more time. Sure, the methods aren't as practical for black-bag-defacing-websites jobs. But it does two major things:
1. It teaches you "The Way Things Work". Thus seperating you as a security admin from a highschooler computer geek in the same way it seperates a hacker and a script kiddie. One knows how it works, how to improve upon it, and how to do it by hand if ever needed. The other has no clue, and just clicks "Start!".
2. The programing in scanners was coded by everyday people, like you and me. And thus, there is room for false positives and faults. Nmap is notorious for this, especially if the scanning speed is bumped up. You can have a scanner say that something is wide open, but until you check it by hand to make sure with your own processing eyes, you're trusting on encapsulation versus first hand "I know it is".
Just two ways to get the job done, and since we are talking about legal hacking and security improvement from a grey/whitehat perspective rather than oldschool underground hacking... it's just safer sometimes for your job and the company to know how to do those manual checks.
perfect answer.
Yeah i prefer to code these things for myself as i said above i am currently developing a security scanner(a all in one kinda)it is not difficult at all it gives you a through knowledge of holw these things work.
Yeah kinda i am trying to grow up lets see...... :DQuote:
Okay, it may just be me. But I'm seeing this from a greyhat
When you release the alpha version of your scanner let me know, more than happy to test it out with you :)
45 days from now my exams are on now i will start my work after that.and i will post that code on AO that is a promiseQuote:
Originally posted here by poohsuntzu
When you release the alpha version of your scanner let me know, more than happy to test it out with you :)
should be obvious, anytime you're looking for tools or just looking for something to do, go here:
http://www.insecure.org/tools.html
Nessus actually produces less False positives then retina so it may actually work out to be even more use (getting back to the original post). Tenable NewT is the version that has been ported to Windows and once your trial has expired its very expensive. You could always run the Nessus server on Linux and then one of the many Windows frontends if you wish to primarily use windows.
Whichever way you do it, the best way I find when performing either a vulnerability scan, or a noisy pen test (i.e. the client doesn`t want you to be sneaky about it) is to use one of the automated scanning tools and then manually check any exploits you have that are not covered by the scanner. All the scanning tools miss things (vulnerability scanners I mean) so you should plan on doing some manual checks atferwards, but typically you are not going to have 3 weeks to manually check for 1800 vulnerabilities +, and if you do then please send me the details on where you work...
You may also want to look at some of the scanning appliances out there, a couple are based on Nessus, although right now all the names escape me...its been a long day...whilst the initial layout is a wee bit in the long run they tend to work out well, depending on how large you network is.
One other thing to keep in mind is that for many organizations these scans/tests are now required, the SEC is very fond of them as is the FDIC (which actually requires them now)for financial institions.
Also, all the scanning and testing in the world is not worth anything if you don`t have some kind of remediation process in place which tracks the vulnerabilities you find and how you fix them. Typically the scan is then, the findings are then assessed and ones that need to be dealt with identified (there may be different levels applied) and action plans developed. You should plan to keep these tracking sheets and not just delete the holes as they are fixed (this shows the auditors that you are actually doing what you say you are doing), and write up a policy document on what you are doing and how you are doing.