On Mar 26, 2008, at 4:45 AM, Chak Kevin wrote: > I am trying to understand how Nessus identify a host is a web server > (or internet facing system) or just a regular workstation. Have this > identification been implemented in the source code? Or Nessus do > this by using some specific plugins?
Service detection isn't as black and white as this -- a host isn't identified as being a web server or workstation. Instead, Nessus attempts to identify the services running on the various ports(s) being scanned so in theory it will catch the web server running along with MySQL, SSH, and SMTP. Nessus uses plugins for this. Some such as #10330, #17975, and #11153 are fairly general - they send a request to a port and make a determination based on the banner or the results returned. Others are specific to a single application / protocol. George -- [EMAIL PROTECTED] _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
