On Monday 18 June 2007 19:42, Tim Brown wrote:
> Merging the local checks for each platform? This can be done, and in fact
> I think these checks could be built in an automated fashion, at least on
> Debian. What do people think?
I am all for automation. Of course it is to be seen as a automated
preparatory work for the actual human being that checks and signs.
Have you a special plan in mind how you want to combine the
aggregation and automation for new issues? Perhaps monthly, yearly
aggregation?
> Web application checks appear to be tested rather arbitrarily, with some
> checks within application scripts, some in dangerous_cgi.nasl etc... It
> all seems a bit haphazard. Now applications is an interest of mine, and
> indeed I have a number of checks to add, but what are peoples thoughts
> about how to organise these checks? How about with directory traversals
> and file include flaws?
You are referring to the proposal of "Generic Plugins"?
I have no odea yet how to organise. But at least it should
be a family of its own, so we at a place the collects these types of
tests. I guess over time some general functions will go into supporting
".inc"-files.
> Finally, to what level do people feel it is necessary to check flaws such
> as stack and heap overflows? Where possible just validate by version? Or
> some more in depth form of check? What happens if we can't get a version
> number back from the application?
Maybe have two separate tests, one that is marked as "dangerous"?
> My ideal world would be 1 OSVDB entry, 1 script and validate to whatever
> level allows confirmation that the bug really exists, but let me know what
> you think.
BTW: I like the idea of a closer link to OSVDB in general.
IIRC the current concept
makes it difficult for a single plugin to act as non-dangerous and
dangerous plugin at the same time?
Best
Jan
--
Dr. Jan-Oliver Wagner Intevation GmbH
Amtsgericht Osnabrück, HR B 18998 http://www.intevation.de/
Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
_______________________________________________
Openvas-plugins mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-plugins
