On Thu, Jul 28, 2005 at 01:20:55PM -0400, Lu, Xi wrote:
> Can someone help me understand how Nessus works without crashing the
> target machine?
It does this in the same way you'd probably do it if you didn't have a
tool such as Nessus to use; eg,
o Get the installed version locally
With the right credentials, Nessus may be able to gather
version information from the target locally by, say,
checking the registry or running rpm.
o A banner check
These aren't always reliable because banners can generally be
hidden / faked, and software distributed as part of a package
often fixes the flaw without changing the banner.
o Check for an associated flaw.
If the software is affected by multiple flaws, one of which
is a buffer overflow and others are not, you may be able
to check for the other flaws and be reasonably sure the
buffer overflow exists.
Even so, there are some cases in which the only option is to try to
exploit the flaw directly, and Nessus will use that too provided safe
checks have been disabled (they're not, by default).
George
--
[EMAIL PROTECTED]
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
