The GUI is the easiest place to configure the scan for a new user. RedLegg has encountered several configurations that have caused issues with scans. These issues could be every port being open, or zero ports open on host that is known to be accessible. Sensitive networks can become congested and give false positives, bad results, and have impact on production networks. Network issues can be mitigated beforehand by communicating with the client on the network load of sensitive equipment, high priority hosts, and high availability hosts. Legacy hardware, such as printers, can cause similar “denial of service” conditions. Many of these issues have options in Nessus for quick configuration changes while the scan is running, allowing the user to fix potential issues on the fly.
Portsĭuring our scanning efforts against targeted hosts, we have seen Nessus report every port as open, usually when scanning a target list that is for a web application. These results can be caused by a firewall or content delivery network (CDN) accepting connections on all ports and then forwarding that traffic based on access control rules. When using this against an external target list, the issue is usually caused by a CDN or another web-based target. However, when used against an internal target set, this issue can arise from scanning a VMWare-based client. To mitigate this, under Discovery in an Advanced Scan, turn off “Ping the remote host.” This will stop the scanning host from using ICMP to determine if a host is live, allowing the scan to continue. ICMP may be passed through a firewall and will return an “ICMP Unreachable” message 1. This is a false positive in Nessus by saturating the results of the scan with thousands of informational findings. Sensitive networks can also prove to be troublesome. In many of Tradecraft Labs engagements, we have been tasked to examine a development or staging environment.
While many issues do not progress beyond simple IP whitelisting and access control, some can cause network congestion. Rate limiting is useful when congestion issues occur. Options for rate limiting a scan are under Advanced > Performance Options. Adjust the “Max Concurrent Checks Per Host” if the target is a web application or service that may be under a heavy load. Adjusting this option will limit the number of plugins simultaneously scanning the host.
0 kommentar(er)
