Re: [Plugins-writers] Nmap.nasl

From: Michel Arboi (mikhail@private)
Date: Tue Jun 14 2005 - 03:30:58 PDT


On Tue Jun 14 2005 at 12:16, Herman Young wrote:

> I would suggest having one, generic input box where the user can enter their
> nmap parameters (Example: -n -P0 --min_parallelism 100 --max_scan_delay 0)
> If the user does not enter additional parameters, default ones are assigned
> (Example: -n -P0)

> What do you think?

This would be a security risk, as nothing guarantees that nmap
correctly handles crazy options. Don't forget that the command is run
as root on the Nessus server. 
We would have to parse the options and do some sanity checks. I don't
know which ones...

It is much simpler and safer to run Nmap before the Nessus scan, then
import the results. You can run Nmap against you whole network, it is
supposed to be quicker this way.


_______________________________________________
Plugins-writers mailing list
Plugins-writers@private
http://mail.nessus.org/mailman/listinfo/plugins-writers



This archive was generated by hypermail 2.1.3 : Tue Jun 14 2005 - 03:43:03 PDT