Erik,
To add to Sullo's comments, I would even pipe the output of nikto.pl to a text file. I
looked at the source for only 3 minutes, so I may be *very* incorrect, but....
> send(4, "SERVER <|> NOTE <|> 10.0.0.5 <|>"..., 64999, 0) = 64999
you are sending a buffer of 65,000 - 1 bytes, however
> set key SentData/10864/NOTE/1 -> 136245768
nikto.pl is generating 136,245,768 bytes.
Are you *really* getting that large amount of nikto output?
(P.S. Excellent research so far...)
--Keith
-----Original Message-----
From: [EMAIL PROTECTED] on behalf of [EMAIL PROTECTED]
Sent: Tue 2/17/2004 6:56 PM
To: Erik Stephens
Cc: [EMAIL PROTECTED]
Subject: Re: Scan hangs near nikto_wrapper against squid
Erik,
Have you tried running that nikto command from the CLI directly? Does it
hang...or does it work?
That would be the simplest place to start, I would think.
-Sullo
Quoting Erik Stephens <[EMAIL PROTECTED]>:
> Greetings,
>
> I can cause a nessus process (version 2.0.10 w/ gcc 2.95.4) to hang when
> scanning a host (ip 10.0.0.5 in this case) that has a squid server
> listening (port 3128 in this case). I'm not sure if this is a nessus,
> nikto, or squid issue. A dump of the diagnostics that I was able to
> gather:
>
> When strace'ing the nessusd process that runs the scan (1 level of
> forking deep I think), it will consistently hang at this point:
>
> < a whole bunch of select & recv calls >
> waitpid
> waitpid
> sigreturn
> send(4, "SERVER <|> NOTE <|> 10.0.0.5 <|>"..., 64999, 0) = 64999
> recv(4,
>
> In the nessusd.dump file, it will die shortly after running the
> nikto.pl script:
>
> nessus_popen: running nikto.pl - nikto.pl -h 10.0.0.5 -p 3128
> fgets: EOF
>
> set key SentData/10864/NOTE/1 -> 136245768
> set key Success/10864 -> 1
> set key /tmp/Success/10864 -> 1
>
> In the squid access log, the last entry that I see is a PROPFIND request,
> which I haven't researched what that entails yet:
>
> 1077058572.408 3 10.0.0.6 TCP_DENIED/400 1448 PROPFIND / - NONE/-
> text/html
>
>
> Again, I don't know what to dive into: nessus, nikto, or squid. Any
> thoughts? Any better way of gathering some diagnostics? Thanks.
>
>
> Best regards,
> Erik Stephens www.edgeos.com
> Managed Vulnerability Assessment Services
> _______________________________________________
> Nessus mailing list
> [EMAIL PROTECTED]
> http://mail.nessus.org/mailman/listinfo/nessus
>
--
http://www.cirt.net/ | http://www.osvdb.org/
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
