NeXpose Vulnerability Scanner
Capabilities
- Remote vulnerability scanning
- OS: Microsoft Windows, Linux, Solaris, Mac OS, BSD, AIX, AS/400
- Databases: SQL Server, MySQL, Oracle, PostgreSQL
- Web: Apache, IIS, QuickTime, Flash, ColdFusion, J2EE, PHP, ASP, ASP.NET
- Custom web app issues: SQL injection, cross-site scripting, backup script files, readable CGI scripts, insecure use of passwords, leakage of sensitive data
- Device discovery and fingerprinting
- Web spidering
- Default or trivial account credentials
- Credentials-based scanning
- Vulnerabilities
- Insecure configurations
- Missing patches
- Spyware
- OS: Red Hat, SuSE, Solaris, Microsoft
- Applications: Microsoft products, Real Player, Opera, OpenOffice, etc.
Benefits
- Low false-positive rate (handled as bugs)
- Three checks done for each vulnerability
- New vulnerability checks available within 1 business day of publication
- Flexible reporting (PDF, HTML, XML, etc)
- No local software required (browser-based)
- Separate scanning engine for firewalled hosts
To Use
- Contact security@isc.upenn.edu
to request access for scanning and reporting on your hosts.
- Provide a list of the IP addresses or hostnames you wish to scan (max 100 per site).
- Indicate the PennKey usernames of the individuals who should be authorized
to run the scans.
- Indicate which email addresses should be added to our VULN-SCANNER-USERS@lists.upenn.edu mailing list for announcements.
- Using any Penn-supported browser, log in to NeXpose using your PennKey
credentials: https://scanner.security.isc.upenn.edu:3780/
- Select your site and the scan you wish to run.
- Set up desired alerts (e.g. upon scan completing, type of vulnerabilities detected), specifying probe.security.isc.upenn.edu as the SMTP relay server.
- Configure credentials, if desired (for more thorough scan).
- Advise others that you plan to use the scanner (multiple simultaneous
scans can delay completion) using the Provier Wiki.
- Run scan and generate a report in the format you desire.
Scanning
- Site Size: the maximum recommended size of a site is 100 hosts.
- The default scan: ("Full Audit") includes web spidering, which
may hang
in certain instances (e.g. printers, some dynamically-generated URLs). The workarounds are:
- Select "Full Audit, no web spidering." Note that checks for
SQL injection, cross-site scripting (CSS/XSS), backup script files, readable CGI scripts, and insecure use of passwords will be omitted as well.
- Ask Information Security to configure a scan template that excludes a
certain path (e.g. /calendar). This will allow you to check the rest of your site for vulnerabilities, but still have a
scan go to completion.
- Scan Template Options (contact security@isc.upenn.edu for more details on any of these templates)
- Length of Scans: a good rule of thumb is that the full audit will take 2 minutes/workstation, and 5 minutes/server. See note above regarding
web spidering with the default scan.
Scanning behind a Firewall
If you would like to scan hosts behind a firewall, you may install a NeXpose scanning engine on your local system and use our floating scanner license.
System Requirements:
- OS: Windows 2000 Server, Windows 2003, Linux
- Hardware: 2 GHz, 2 GB RAM, 80 GB disk
Instructions:
- Download NeXpose scanner for Linux or Windows
- Follow Installation Manual instructions for your platform.
- Install scan engine only (not typical installation).
- Open a hole in your firewall to permit traffic from scanner.security.isc.upenn.edu to your host on port 40814.
- Let security@isc.upenn.edu know
the hostname of your host.
- Once we've added the scan engine, use the scan engine command line (screen -x nexpose on Linux) to enable connection to the scan console (see page 25 of the installation manual).
- To exit the scan engine command line, type Ctrl, A, and D keys together. Do not use Ctrl-C as this will stop NeXpose.
- Connect to the NeXpose console to initiate a scan of your site, selecting the scanner you installed.
Reporting
CSV Reports: Although NeXpose can produce a CSV report, the vendor recommends generating an XML report instead, and using this Windows utility
to convert it to CSV.
References
NeXpose Quick Install Guide for installing scanner behind firewall
NeXpose Manual for using NeXpose interface
NeXpose Scan Tuning
Presentation at Security-SIG from December 2008
Last updated: Tuesday, September 15, 2009
|
