Vulnerability scanners

[pezz]

Have been using a few script kiddie tools to evaluate a web box. The box is running IIS 5.o, w2k server. One vulnerability scanner detected /_vti_bin/shtml.exe vulnerabilities and /?pageservices vulnerabilities.

Although this box is a prod box, it does NOT have SP3 installed.

I have been doing additional research on both vulnerabilities in general and have located a file on packetstorm which details that by going into the view menu on net scape you should be able to reveal the root directories of this box. I have not been able to do this. (netscape 7.1)

In addition, running a basic port scan on this box using Solar winds network browser does not reveal SNMP info or accounts, shares, services running, etc...


On a scale of 1 to 10 how would you rate the safety of this site in relation to possible attacks. I understand how to correct the shtml.exe problem but I am unsure if installing SP3 will correct the problem with the Front page extension vulnerabilities.

[pbxphreak]

depends what kinda machine you are scanning from, you can install nessus, which is pretty much the best scanning tool, you can install it on a *nix box, then just update the plugins as they come out the new vulns, and then install the windows software and it connects to your linux/bsd server.

or if you want to use a windows scanner, their is a good cgi scanner called voideye scanner check for it on google.

[murakami]

Have been using a few script kiddie tools to evaluate a web box. The box is running IIS 5.o, w2k server. One vulnerability scanner detected /_vti_bin/shtml.exe vulnerabilities and /?pageservices vulnerabilities.

On a scale of 1 to 10 how would you rate the safety of this site in relation to possible attacks. I understand how to correct the shtml.exe problem but I am unsure if installing SP3 will correct the problem with the Front page extension vulnerabilities.

I'm confused on which Front Page vulnerability you are talking about.

There is a buffer overflow exploit (patched by SP3 - is a cummulative patch so it might have been patch earlier)

The /?pageservices relates to Netscape Enterprise server, are you running this along with IIS? Some scanners show a false positive. You could try Nikto or Spike and see what they report.

[mpkn3rd]

Just curious, but I thought sp4 took care of some of those issues as well as new ones.

I also am running IIS on a Win2K server and it checks out quite a bit tighter than sp2. I read about some issues, but finally bit the bullet and loaded it several weeks after it came out. No problems for once.

[pezz]

The /?pageservices relates to Netscape Enterprise server, are you running this along with IIS? Some scanners show a false positive. You could try Nikto or Spike and see what they report.

FALSE POSITIVE!!! No existance of the netscape enterprise server configuration. I ran the same scanner on a few other boxs that I have installed IIS on and it came back positive as well. I had referenced several sites while researching this and got a little confused by some misleading information.

I have been fooling around with a few tools and wanted to get my information corrected BEFORE I try to explain it to students.

Scanner: CGI Vulnerabilty scanner from PacketStorm for Win32(Simpsons)

Thanks for the info I will try the others!!!

[Chris]

Rather than copy/paste shit I have said before I will point you toward some of my scanner observations:

http://forums.netstumbler.com/showth...&threadid=8657



http://forums.netstumbler.com/showth...&threadid=8886