Cool, a response ;)
On Friday 04 January 2002 01:14 am, Georges Dagousset wrote: > Hello, > > 5 comments: > 1/ In mssql_brute_force.nasl, you need to initialize 'report' at the > beginning of the plugin. I wrote the brute force one first and then copied/changed the code, forgot to remove that one instance. Thanks for catching it ;) > 2/ You could add the CVE-2000-0402 Yup, will do. > 3/ In both, it could be good to change the report. > The 'sa' account has a blank password. > could be > The 'sa' account has a blank password in SQL Server. True, it needs some verbosity in the message. > 4/ In mssql_brute_force.nasl, the category could be change to ACT_ATTACK. > (I'm not sure). Not sure either, Renaud or Michael want to chime in? > 5/ Why did you change the description for mssql_blank_password.nasl. > There is no 'Risk factor' anymore. Copied from a template, didn't add it back in. I was more interested in technical/fuctionality problems right now, was going to clean them up after I got some feedback. Did you get a chance to try them against a SQL Server? I tested on 7.0 only (english) and would like people with accessible 6.5 and 2000 servers to give it a shot and make sure it works. When writing the plugin, I found numerous ways to take down SQL Server 7.0 with bad packets, so be careful when trying it on any system other than 7.0 (where it was tested thoroughly and should not crash). Thanks for the feedback ;) -HD > Regards, > > Georges Dagousset > > ----- Original Message ----- > From: "H D Moore" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, January 04, 2002 7:37 AM > Subject: Fwd: New Microsoft SQL Server Plugins! > > > I got responses back from the plugin-writers list, figured someone here > > might > > > want to test these new scripts out ;) > > > > ---------- Forwarded Message ---------- > > > > Subject: New Microsoft SQL Server Plugins! > > Date: Thu, 3 Jan 2002 15:36:15 -0600 > > From: H D Moore <[EMAIL PROTECTED]> > > To: [EMAIL PROTECTED] > > > > I rewrote my SQL Server blank "sa" account plugin and added another one > > to brute force user accounts, comments are welcome! > > > > -HD
