ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    So you want to build a Security Program? Part 1 - Vulnerability Scanning

    IT Discussion
    13
    72
    6.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      momurda
      last edited by

      I have installed using the hyperv image on my workstation. Have run a scan.
      The scan results don't make any sense.
      It is showing I am running about 10 different insecure versions of linux kernel, none of which I am running on the machine I scanned.
      0_1498164745454_18784078-6253-4249-812b-2d0080ce5b85-image.png
      Above is a snippet of a pdf report of the scan showing me a list of kernels which are not on this server as far as I know.
      uname -r
      returns
      0_1498164802671_93cf14bc-7db8-4554-8f84-e0b3bd49b518-image.png

      I 1 Reply Last reply Reply Quote 0
      • M
        momurda
        last edited by

        Running
        rpm -qa | grep kernel
        showed 5 or 6 kernels still installed. whoops.
        package-cleanup --oldkernels --count=2 removed all but the current and next oldest one.

        B 1 Reply Last reply Reply Quote 2
        • C
          CloudKnight
          last edited by

          It's defiantly taking my cpu for a sprint.....

          0_1498167159068_2017-06-22 22_30_53-.png

          1 Reply Last reply Reply Quote 0
          • B
            BRRABill @momurda
            last edited by

            @momurda said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

            Running
            rpm -qa | grep kernel
            showed 5 or 6 kernels still installed. whoops.
            package-cleanup --oldkernels --count=2 removed all but the current and next oldest one.

            OpenVAS FTW.

            1 Reply Last reply Reply Quote 2
            • I
              IRJ
              last edited by

              As mentioned in the OP, OV is very resource inefficient. Nessus is a night and day difference, but isn't cheap.

              1 Reply Last reply Reply Quote 0
              • I
                IRJ @momurda
                last edited by

                @momurda said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                I have installed using the hyperv image on my workstation. Have run a scan.
                The scan results don't make any sense.
                It is showing I am running about 10 different insecure versions of linux kernel, none of which I am running on the machine I scanned.
                0_1498164745454_18784078-6253-4249-812b-2d0080ce5b85-image.png
                Above is a snippet of a pdf report of the scan showing me a list of kernels which are not on this server as far as I know.
                uname -r
                returns
                0_1498164802671_93cf14bc-7db8-4554-8f84-e0b3bd49b518-image.png

                I've seen this before when credentials don't work and a vulnerability scanner has to guess the OS version. Are you sure the credentials worked on that first scan?

                I 1 Reply Last reply Reply Quote 0
                • I
                  IRJ @IRJ
                  last edited by

                  @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                  @momurda said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                  I have installed using the hyperv image on my workstation. Have run a scan.
                  The scan results don't make any sense.
                  It is showing I am running about 10 different insecure versions of linux kernel, none of which I am running on the machine I scanned.
                  0_1498164745454_18784078-6253-4249-812b-2d0080ce5b85-image.png
                  Above is a snippet of a pdf report of the scan showing me a list of kernels which are not on this server as far as I know.
                  uname -r
                  returns
                  0_1498164802671_93cf14bc-7db8-4554-8f84-e0b3bd49b518-image.png

                  I've seen this before when credentials don't work and a vulnerability scanner has to guess the OS version. Are you sure the credentials worked on that first scan?

                  Nvm reading comprehension helps.. Lol

                  1 Reply Last reply Reply Quote 0
                  • I
                    IRJ
                    last edited by

                    Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                    D 1 Reply Last reply Reply Quote 1
                    • D
                      dafyre @IRJ
                      last edited by

                      @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                      A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                      Have you tried throwing more CPU cores at OpenVAS instead of / in addition to RAM?

                      I ran it on 4GB RAM / 4 CPU Cores for ~30 Servers and got reasonable performance out of it.

                      I 3 Replies Last reply Reply Quote 1
                      • I
                        IRJ @dafyre
                        last edited by

                        @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                        A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                        Have you tried throwing more CPU cores at OpenVAS instead of / in addition to RAM?

                        I ran it on 4GB RAM / 4 CPU Cores for ~30 Servers and got reasonable performance out of it.

                        How long did it take to complete on 30+ servers?

                        D 1 Reply Last reply Reply Quote 0
                        • I
                          IRJ @dafyre
                          last edited by

                          @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                          A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                          Have you tried throwing more CPU cores at OpenVAS instead of / in addition to RAM?

                          I ran it on 4GB RAM / 4 CPU Cores for ~30 Servers and got reasonable performance out of it.

                          Yes I have, but part of my bias is total time of scans compared to other solutions. I bet a Nessus scanner with 1GB of ram on 2 cores would finish in less than half the time. So I am comparing efficiency here.

                          1 Reply Last reply Reply Quote 0
                          • D
                            dafyre @IRJ
                            last edited by

                            @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                            A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                            Have you tried throwing more CPU cores at OpenVAS instead of / in addition to RAM?

                            I ran it on 4GB RAM / 4 CPU Cores for ~30 Servers and got reasonable performance out of it.

                            How long did it take to complete on 30+ servers?

                            I don't rightly remember an exact number, but I want to say an hour or three running the full, no-holds-barred scans. (I crashed a vulnerable server a time or two with it, ha ha!)

                            1 Reply Last reply Reply Quote 0
                            • I
                              IRJ @dafyre
                              last edited by

                              @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                              A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                              Yes, but in addition to the vulnerability scans you are going to see special scans depending on what they find. If I find a wordpress site, you better believe I am kicking off wpscan to look for weaknesses. If I know it is a DB server, I am going to try some SQL and oracle scans. You get the point.

                              So don't forget to run those type of scans with information you can gather from a non-credentialed scan.

                              D 1 Reply Last reply Reply Quote 2
                              • D
                                dafyre @IRJ
                                last edited by

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                                A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                                Yes, but in addition to the vulnerability scans you are going to see special scans depending on what they find. If I find a wordpress site, you better believe I am kicking off wpscan to look for weaknesses. If I know it is a DB server, I am going to try some SQL and oracle scans. You get the point.

                                So don't forget to run those type of scans with information you can gather from a non-credentialed scan.

                                Does OpenVAS do this now? I don't recall that it did before (admittedly, it has been a while since I've used it.

                                I 1 Reply Last reply Reply Quote 0
                                • I
                                  IRJ
                                  last edited by

                                  For anyone that wants to test OpenVAS on something that is not remotely production and see OpenVAS light up like a christmas tree, OWASP has a very vulnerable VM you can download.

                                  https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project

                                  1 Reply Last reply Reply Quote 1
                                  • I
                                    IRJ @dafyre
                                    last edited by

                                    @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @dafyre said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    Another thing to note is that Credentialed scans are much more polite compared to non Credentialed scans. Non Credentialed scans are much more taxing on the box since everything is guessed slamming the box.

                                    A non-credentialed scan would be more akin to a hacker attacking and trying to get in, I would think.

                                    Yes, but in addition to the vulnerability scans you are going to see special scans depending on what they find. If I find a wordpress site, you better believe I am kicking off wpscan to look for weaknesses. If I know it is a DB server, I am going to try some SQL and oracle scans. You get the point.

                                    So don't forget to run those type of scans with information you can gather from a non-credentialed scan.

                                    Does OpenVAS do this now? I don't recall that it did before (admittedly, it has been a while since I've used it.

                                    No. Most of those tools are available in Kali, but I prefer to use Ubuntu and install what I need.

                                    1 Reply Last reply Reply Quote 1
                                    • DustinB3403D
                                      DustinB3403
                                      last edited by

                                      So I've been using OpenVAS for a while now, and the results are enlightening. One question though is how do I make sure my the NVT's are current?

                                      I tried running openvasmd --update && openvasmd --rebuild from a shell and was told that openvasmd isn't recognized

                                      1 Reply Last reply Reply Quote 0
                                      • stacksofplatesS
                                        stacksofplates
                                        last edited by

                                        So @IRJ I wasn't sure where else to put this. Do you give root access to your vulnerability scanners? Just a conversation I've been having with some people here.

                                        I 1 Reply Last reply Reply Quote 0
                                        • I
                                          IRJ @stacksofplates
                                          last edited by

                                          @stacksofplates said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                          So @IRJ I wasn't sure where else to put this. Do you give root access to your vulnerability scanners? Just a conversation I've been having with some people here.

                                          Unfortunately they need root to scan according to tenables documentation. You can set a specific login window for that account to correlate with your scan. That way it isn't abused anywhere besides during the scan window. Not really 100% secure, but it's better than leaving it wide open.

                                          stacksofplatesS 1 Reply Last reply Reply Quote 0
                                          • stacksofplatesS
                                            stacksofplates @IRJ
                                            last edited by stacksofplates

                                            @irj said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                            @stacksofplates said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                            So @IRJ I wasn't sure where else to put this. Do you give root access to your vulnerability scanners? Just a conversation I've been having with some people here.

                                            Unfortunately they need root to scan according to tenables documentation. You can set a specific login window for that account to correlate with your scan. That way it isn't abused anywhere besides during the scan window. Not really 100% secure, but it's better than leaving it wide open.

                                            Ya we do SCAP with the RedHat SCAP tool. We don't control the Nessus box so we weren't going to give up root access, and they are essentially just checking patch levels.

                                            What I don't get is why they need root access. If there is a vulnerability, it has to be able to be seen/leveraged from an unprivileged account. Sure you can see vulnerabilities when you log in as root, because you are the vulnerability. I think it's kind of pointless.

                                            I 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 2 / 4
                                            • First post
                                              Last post