Menu > Articles de la revue de presse : - l'ensemble [tous | francophone] - par mots clé [tous] - par site [tous] - le tagwall [voir] - Top bi-hebdo de la revue de presse [Voir]

---

S'abonner au fil RSS global de la revue de presse

---

Présentation : Working with Policies --------------------- Policies in Nessus is where we define what a scan is going to do from What plugins to run. What types of plugin should run and which should not. Concurrency. Port Scanning Settings. Credentials and many many many more. This is why when I started looking at using PowerShell for automation I came to the conclusion that creating polices and editing them is much better in a GUI than in a shell. But still I included some basic functions for working with policies. Lets start by listing what policies are in the server PS Show-NessusPolicy -Index 0 PolicyID PolicyName PolicyOwner Visibility -------- ---------- ----------- ---------- -4 Internal Network Scan Tenable Policy Distributio... shared -3 Web App Tests Tenable Policy Distributio... shared -2 Prepare for PCI-DSS audits... Tenable Policy Distributio... shared -1 External Network Scan Tenable Policy Distributio... shared 8 Exploit Available Only carlos private 7 Moderate Scan carlos private 6 All Plugins with Full Scan carlos private We can make copies of existing Policies PS Copy-NessusPolicy -Index 0 -PolicyID 8 PolicyID PolicyName PolicyOwner Visibility -------- ---------- ----------- ---------- 9 Copy of Exploit Available ... carlos private We can also remove exiting policies PS Remove-NessusPolicy -Index 0 -PolicyID 9 True You can also download the XML for a policy as a XML .Net Object, you can download the XML in to file quite easily using the methods offered by .Net PS C Show-NessusPolicy -Index 0 -PolicyID 1 PolicyID PolicyName PolicyOwner Visibil -------- ---------- ----------- ------- 1 Mobile Devices Audit carlos private PS C MobilePolicy Get-NessusPolicyXML -Index 0 -PolicyID 1 PS C MobilePolicy.Save env HOMEPATH Desktop mobilepolicy.xml You can also manipulate the object and query quite easyly in powershe the Policy XML to get more detailed information about a given policy PS C MobilePolicy Get-NessusPolicyXML -Index 0 -PolicyID 1 PS C MobilePolicy.NessusClientData_v2.policy.policyContents.FamilySelection.FamilyItem FamilyName Status ---------- ------ MacOS X Local Security Checks disabled DNS disabled Gain a shell remotely disabled Solaris Local Security Checks disabled Port scanners disabled Web Servers disabled SMTP problems disabled Service detection disabled CGI abuses XSS disabled Mandriva Local Security Checks disabled Databases disabled Debian Local Security Checks disabled Denial of Service disabled Default Unix Accounts disabled Settings disabled HP-UX Local Security Checks disabled Backdoors disabled VMware ESX Local Security Checks disabled SCADA disabled General disabled Red Hat Local Security Checks disabled FreeBSD Local Security Checks disabled CGI abuses disabled Windows User management disabled Netware disabled Peer-To-Peer File Sharing disabled Slackware Local Security Checks disabled SNMP disabled Fedora Local Security Checks disabled Gentoo Local Security Checks disabled Ubuntu Local Security Checks disabled Misc. disabled FTP disabled Firewalls disabled Windows Microsoft Bulletins disabled Junos Local Security Checks disabled Mobile Devices enabled Windows disabled Policy Compliance disabled SuSE Local Security Checks disabled RPC disabled CentOS Local Security Checks disabled CISCO disabled Scientific Linux Local Security Checks disabled AIX Local Security Checks disabled I do promise in the future a bit more manipulation of policies, command line in this case will not be as flexible as the GUI but it should help for some simple tasks. I m looking at the simpler JSON API added in the HTML5 interface for this, it will limit the functions to only version 5.x but then again we are all using the latest version, right Winking smile Working with Scan Templates --------------------------- Scan templates are the most used method for storing specific configuration for scan that already have a policy configured and a set of targets selected. The scan Templates can also be scheduled to run at specific intervals. I have written some functions for creating and launching scan templates. Before creating a Scan Template we first need to know the IDs of the existing policies since that ID is used in the creation since we may have several policies with the same name but with different settings. In this next example I want to create a template for scanning my home development network where I host all my virtual machines PS Show-NessusPolicy -Index 0 PolicyID PolicyName PolicyOwner Visibility -------- ---------- ----------- ---------- -4 Internal Network Scan Tenable Policy Distributio... shared -3 Web App Tests Tenable Policy Distributio... shared -2 Prepare for PCI-DSS audits... Tenable Policy Distributio... shared -1 External Network Scan Tenable Policy Distributio... shared 8 Exploit Available Only carlos private 7 Moderate Scan carlos private 6 All Plugins with Full Scan carlos private PS New-NessusScanTemplate 0 -TemplateName Dev Lab Full Scan -PolicyID 6 -Targets 192.168.10.1-192.168.10.2 TemplateID template-b9d6c48e-516a-fe81-4294-458df6acfd45a74d7adc86d4815b PolicyID 6 PolicyName Name Dev Lab Full Scan Owner carlos Targets 192.168.10.1-192.168.10.254 As you can see the creation of the template is quite simple. The targets can be either individual hosts and or ranges separated by commas with no spaces between them or a PowerShell collection that can be passes also. Lets take a look at the scan templates we have on the server PS Show-NessusScanTemplate -Index 0 TemplateID template-b9d6c48e-516a-fe81-4294-458df6acfd45a74d7adc86d4815b PolicyID 6 PolicyName All Plugins with Full Scan Name Dev Lab Full Scan Owner carlos Targets 192.168.10.1-192.168.10.254 Each scan template has a unique Template ID we use this ID when we work with the template. Lets update the existing template targets, I want to have it cover the same range bust skip some hosts I do not want scanned, I can do this using other functions provided by Posh-SecMod for working with IPs PS excludelist 192.168.10.20,192.168.10.80,192.168.10.200,192.168.10.201 PS ips New-IPRange -CIDR 192.168.10.0 24 PS targets ips .IPAddressToString -notin excludelist pourcents .IPAddressToString PS Update-NessusScanTemplate -Index 0 -TemplateID template-b9d6c48e-516a-fe81-4294-458df6acfd45a74d7adc86d4815b -Targets targets TemplateID template-b9d6c48e-516a-fe81-4294-458df6acfd45a74d7adc86d4815b PolicyID 6 PolicyName Name Dev Lab Full Scan Owner carlos Targets 192.168.10.1 192.168.10.2 192.168.10.3 192.168.10.4 192.168.10.5 192.168.10.6 192.168.10.7 192.168.10.8 192.168.10.9 192.168.10.10 192.168.10.11 192.168.10.12 192.168.10.13 192.168.10.14 192.168.10.15 192.168.10.16 192.168.10.17 192.168.10.18 192.168.10.19 192.168.10.20 192.168.10.21 192.168.10.22 192.168.10.23 192.168.10.24 192.168.10.25 192.168.10.26 192.168.10.27 192.168.10.28 192.168.10.29 192.168.10.30 192.168.10.31 192.168.10.32 192.168.10.33 192.168.10.34 192.168.10.35 192.168.10.36 192.168.10.37 192.168.10.38 192.168.10.39 192.168.10.40 192.168.10.41 192.168.10.42 192.168.10.43 192.168.10.44 192.168.10.45 192.168.10.46 192.168.10.47 192.168.10.48 192.168.10.49 192.168.10.50 192.168.10.51 192.168.10.52 192.168.10.53 192.168.10.54 192.168.10.55 192.168.10.56 192.168.10.57 192.168.10.58 192.168.10.59 192.168.10.60 192.168.10.61 192.168.10.62 192.168.10.63 192.168.10.64 192.168.10.65 192.168.10.66 192.168.10.67 192.168.10.68 192.168.10.69 192.168.10.70 192.168.10.71 192.168.10.72 192.168.10.73 192.168.10.74 192.168.10.75 192.168.10.76 192.168.10.77 192.168.10.78 192.168.10.79 192.168.10.80 192.168.10.81 192.168.10.82 192.168.10.83 192.168.10.84 192.168.10.85 192.168.10.86 192.168.10.87 192.168.10.88 192.168.10.89 192.168.10.90 192.168.10.91 192.168.10.92 192.168.10.93 192.168.10.94 192.168.10.95 192.168.10.96 192.168.10.97 192.168.10.98 192.168.10.99 192.168.10.100 192.168.10.101 192.168.10.102 192.168.10.103 192.168.10.104 192.168.10.105 192.168.10.106 192.168.10.107 192.168.10.108 192.168.10.109 192.168.10.110 192.168.10.111 192.168.10.112 192.168.10.113 192.168.10.114 192.168.10.115 192.168.10.116 192.168.10.117 192.168.10.118 192.168.10.119 192.168.10.120 192.168.10.121 192.168.10.122 192.168.10.123 192.168.10.124 192.168.10.125 192.168.10.126 192.168.10.127 192.168.10.128 192.168.10.129 192.168.10.130 192.168.10.131 192.168.10.132 192.168.10.133 192.168.10.134 192.168.10.135 192.168.10.136 192.168.10.137 192.168.10.138 192.168.10.139 192.168.10.140 192.168.10.141 192.168.10.142 192.168.10.143 192.168.10.144 192.168.10.145 192.168.10.146 192.168.10.147 192.168.10.148 192.168.10.149 192.168.10.150 192.168.10.151 192.168.10.152 192.168.10.153 192.168.10.154 192.168.10.155 192.168.10.156 192.168.10.157 192.168.10.158 192.168.10.159 192.168.10.160 192.168.10.161 192.168.10.162 192.168.10.163 192.168.10.164 192.168.10.165 192.168.10.166 192.168.10.167 192.168.10.168 192.168.10.169 192.168.10.170 192.168.10.171 192.168.10.172 192.168.10.173 192.168.10.174 192.168.10.175 192.168.10.176 192.168.10.177 192.168.10.178 192.168.10.179 192.168.10.180 192.168.10.181 192.168.10.182 192.168.10.183 192.168.10.184 192.168.10.185 192.168.10.186 192.168.10.187 192.168.10.188 192.168.10.189 192.168.10.190 192.168.10.191 192.168.10.192 192.168.10.193 192.168.10.194 192.168.10.195 192.168.10.196 192.168.10.197 192.168.10.198 192.168.10.199 192.168.10.200 192.168.10.201 192.168.10.202 192.168.10.203 192.168.10.204 192.168.10.205 192.168.10.206 192.168.10.207 192.168.10.208 192.168.10.209 192.168.10.210 192.168.10.211 192.168.10.212 192.168.10.213 192.168.10.214 192.168.10.215 192.168.10.216 192.168.10.217 192.168.10.218 192.168.10.219 192.168.10.220 192.168.10.221 192.168.10.222 192.168.10.223 192.168.10.224 192.168.10.225 192.168.10.226 192.168.10.227 192.168.10.228 192.168.10.229 192.168.10.230 192.168.10.231 192.168.10.232 192.168.10.233 192.168.10.234 192.168.10.235 192.168.10.236 192.168.10.237 192.168.10.238 192.168.10.239 192.168.10.240 192.168.10.241 192.168.10.242 192.168.10.243 192.168.10.244 192.168.10.245 192.168.10.246 192.168.10.247 192.168.10.248 192.168.10.249 192.168.10.250 192.168.10.251 192.168.10.252 192.168.10.253 192.168.10.254 Launching and Managing Scans ---------------------------- There are 2 ways to launch scans Launch a Scan using an existing policy Launch a Scan using a Scan Template Lets first launch a scan using a policy and giving it a list of targets PS Invoke-NessusScan -Index 0 -PolicyID 7 -Name Lab Scan 1 -Targets 192.168.10.1-192.168.10.100 ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanName Lab Scan 1 Owner carlos Status running Date 4 14 2013 2 21 02 AM Now lets look at invoking the scan using a pre-configured template PS Invoke-NessusScanTemplate -Index 0 -TemplateID template-b9d6c48e-516a-fe81-4294-458df6acfd45a74d7adc86d4815b ScanID a3fb5b8c-60db-1dda-fac7-ee46c0d0a638ea8ce79ab209483c ScanName Dev Lab Full Scan Owner carlos Status running Date 4 14 2013 2 21 50 AM As it can be seen for repeated scans the template is the way to go since it is already named, a policy is already set and a target list is already present. For quick scans of single devices or hosts the launching of scans using policies is better. We can take a look at the scans with the Show-NessusScans function PS Show-NessusScans 0 ScanID a3fb5b8c-60db-1dda-fac7-ee46c0d0a638ea8ce79ab209483c ScanName Dev Lab Full Scan Owner carlos Status running Date 4 14 2013 2 21 50 AM ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanName Lab Scan 1 Owner carlos Status running Date 4 14 2013 2 21 02 AM As you will be able to see each scan has a unique ScanID, this is what we will use as the way to identify scans so we can manipulate them. Lets look at suspending a scan with Suspend-NessusScan PS Suspend-NessusScan -Index 0 -ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanName Lab Scan 1 Owner carlos Status pausing Date 4 14 2013 2 21 02 AM We can resume the scan with Resume-NessusScan PS Resume-NessusScan -Index 0 -ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanName Lab Scan 1 Owner carlos Status resuming Date 4 14 2013 2 21 02 AM We can also stop the scan Stop-NessusScan PS Stop-NessusScan -Index 0 -ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanID 0c0a28e2-824a-3606-4bd2-965d0da1c62272dde8c29f1faa6d ScanName Lab Scan 1 Owner carlos Status stopping Date 4 14 2013 2 21 02 AM One thing to keep in mind even if you stop the scan that what it has found to that point will still be saved as report.

Les mots clés de la revue de presse pour cet article : powershell nessus
Les videos sur SecuObs pour les mots clés : powershell nessus
Les mots clés pour les articles publiés sur SecuObs : nessus
Les éléments de la revue Twitter pour les mots clé : nessus





Les derniers articles du site "Blog" :

- Malware Trends - Q1 2016
- Simplified DDoS Testing at Scale
- BreakingPoint Captures Real-World 2015 Application Trends
- ATI Minecraft
- Benchmarking Open Source SDN Controllers Are They Ready for Carrier-Grade Services
- The End of Days is Here for Network Blind Spots
- Ixia ATI Research Center Finds Multiple Security Vulnerabilities in IBM Tivoli Storage Manager FastBack
- Introducing PSAttack
- Mobile World Congress 2016 Recap
- Ixia Smarter Security at RSA 2016

---

S'abonner au fil RSS global de la revue de presse

---