Re: False positives due to Dual Behavior of ports

From: Noam Rathaus (noamrat_private)
Date: Fri May 09 2003 - 00:37:50 PDT

Next message: Jackson, Dennis: "arbitrary TCP data packets"

Previous message: Michel Arboi: "Miscellaneous plugins & patchs"
In reply to: Renaud Deraison: "Re: False positives due to Dual Behavior of ports"
Next in thread: Michel Arboi: "Re: False positives due to Dual Behavior of ports"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

Unfortunately I cannot provide packet capture, but I will modify the NES file to
provide some output that I will send to you guys.

Thanks for the help.

Thanks
Noam Rathaus
CTO
Beyond Security Ltd
http://www.SecurITeam.com
http://www.BeyondSecurity.com
----- Original Message -----
From: "Renaud Deraison" <deraisonat_private>
To: <plugins-writersat_private>
Sent: Monday, May 05, 2003 8:16 PM
Subject: Re: False positives due to Dual Behavior of ports


> On Mon, May 05, 2003 at 08:52:49PM +0200, Noam Rathaus wrote:
> > Hi,
> >
> > Well I have been able to gather some more information, disabling the non-SSL
or
> > enabling just the SSL, will cause the problem to go away. So it does seem to
be
> > related to both services running on the same port, with a different
transport
> > handling them.
> >
> > Can you suggest a better method to zero-in on the issue?
>
> Do a packet capture when the plugin runs from within Nessus (not
> standalone, because it needs the results of find_services.nes to see if
> it's a SSL-ized port or not), and send that to me (except if it's 100%
> SSL).
>
>
>
> -- Renaud
>
>

Next message: Jackson, Dennis: "arbitrary TCP data packets"
Previous message: Michel Arboi: "Miscellaneous plugins & patchs"
In reply to: Renaud Deraison: "Re: False positives due to Dual Behavior of ports"
Next in thread: Michel Arboi: "Re: False positives due to Dual Behavior of ports"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu May 08 2003 - 23:39:23 PDT