The false positives can explode in the right circumstances. This is because many of the scripts do very little checking of the results. I.e. if a script does an HTTP GET for /somebad.cgi and the webserver doesn't return a 404, the script assumes the somebad.cgi is installed.
Granted, it's a fair amount of work to do some validation here, but blindly making assumptions can lead to a lot of adrenaline and excitement one your or the client's part. I have two projects in mind for this summer. Write a new and improved GTK GUI and go through all the scripts and make significant corrections and add result validations. David camccuk wrote: >Hello all, > >I've tried to dig through the docs, such as they are, but I don't see anything >related to this: > >I'm using the 2k client to run a scan from a linux box on another >linux server across the LAN. So far, so good. I've tried to switch off >as many windows-specific tests as I can but I still see dozens of >reports of IIS vulnerabilities. Also, various CGI scripts are reported >as being present although they aren't. > >I'm quite happy with the idea of false positives but so many? I don't >know which reports to ignore - some of them are obviously erroneous >but most of them I am unsure. I assume Nessus is testing for IIS vulns >because despite the fact that nmap can guess that this is a linux machine, it >still attempts these other tests? It would >be good to be able to tell it - This is a linux box so forget the IIS >stuff! There are several hundred plug-ins so I dread going through >them all removing Windoze tests. > >Anyone have any advice on setting this up a bit better? Cheers for any >tips. > >cam > >__________________________________________________ >Do You Yahoo!? >Yahoo! - Official partner of 2002 FIFA World Cup >http://fifaworldcup.yahoo.com > >
