Assessment Scan Settings

In some cases, Tenable Nessus cannot remotely determine whether a flaw is present or not. If report paranoia is set to Show potential false alarms, a flaw is reported every time, even when there is a doubt about the remote host being affected. Conversely, a paranoia setting of Avoid potential false alarms causes Tenable Nessus to not report any flaw whenever there is a hint of uncertainty about the remote host. As a middle ground between these two settings, disable this setting.

Configure the delay of the Antivirus software check for a set number of days (0-7). The Antivirus Software Check menu allows you to direct Tenable Nessus to allow for a specific grace time in reporting when antivirus signatures are considered out of date. By default, Tenable Nessus considers signatures out of date regardless of how long ago an update was available (for example, a few hours ago). You can configure this setting to allow for up to 7 days before reporting them out of date.

Tenable Nessus attempts to send spam through each SMTP device to the address listed in this field. This third-party domain address must be outside the range of the site Tenable Nessus is scanning or the site performing the scan. Otherwise, the SMTP server might abort the test.

The test messages sent to the SMTP server or servers appear as if they originated from the address specified in this field.

Tenable Nessus attempts to send messages addressed to the mail recipient listed in this field. The postmaster address is the default value since it is a valid address on most mail servers.

A .txt file that contains usernames that Hydra uses during the scan.

You must enter one username per line, and you must end the file with an empty line. For example:

A .txt file that contains passwords for user accounts that Hydra uses during the scan.

You must enter one password per line, and you must end the file with an empty line. For example:

The number of simultaneous Hydra tests that you want to execute. By default, this value is 16.

Start at Register

The register at which to start scanning.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Specifies which type of browser Tenable Nessus impersonates while scanning.

/

The URL of the first page that Tenable Nessus tests. If you want to test multiple pages, use a colon delimiter to separate them (for example, /:/php4:/base).

Specifies portions of the web site to exclude from being crawled. For example, to exclude the /manual directory and all Perl CGI, set this field to: (^/manual) <> (\.pl(\?.*)?$).

Tenable Nessus supports POSIX regular expressions for string matching and handling and Perl-compatible regular expressions (PCRE).

1000

The maximum number of pages to crawl.

6

Limit the number of links Tenable Nessus follows for each start page.

Disabled

If you enable this setting, Tenable Nessus follows dynamic links and may exceed the parameters set above.

This setting manages the combination of argument values used in the HTTP requests. The default, without checking this option, is testing one parameter at a time with an attack string, without trying non-attack variations for additional parameters. For example, Tenable Nessus would attempt
/test.php?arg1=XSS&b=1&c=1, where b and c allow other values, without testing each combination. This is the quickest method of testing with the smallest result set generated.

This setting has four options:

• Test random pairs of parameters: This form of testing randomly checks a combination of random pairs of parameters. This is the fastest way to test multiple parameters.
• Test all pairs of parameters (slow): This form of testing is slightly slower but more efficient than the one value test. While testing multiple parameters, it tests an attack string, variations for a single variable and then use the first value for all other variables. For example, Tenable Nessus would attempt /test.php?a=XSS&b=1&c=1&d=1 and then cycle through the variables so that one is given the attack string, one is cycled through all possible values (as discovered during the mirror process) and any other variables are given the first value. In this case, Tenable Nessus would never test for /test.php?a=XSS&b=3&c=3&d=3 when the first value of each variable is 1.
• Test random combinations of three or more parameters (slower): This form of testing randomly checks a combination of three or more parameters. This is more thorough than testing only pairs of parameters. Increasing the amount of combinations by three or more increases the web application test time.
• Test all combinations of parameters (slowest): This method of testing checks all possible combinations of attack strings with valid input to variables. Where all pairs testing seeks to create a smaller data set as a tradeoff for speed, all combinations makes no compromise on time and uses a complete data set of tests. This testing method may take a long time to complete.
  

This setting determines when a new flaw is targeted. This applies at the script level. Finding an XSS flaw does not disable searching for SQL injection or header injection, but unless otherwise specified, there is at most one report for each type on a given port. Note that several flaws of the same type (for example, XSS or SQLi) may be reported if they were caught by the same attack.

If this option is disabled, as soon as a flaw is found on a web page, the scan moves on to the next web page.

If you enable this option, select one of the following options:

• Stop after one flaw is found per web server (fastest) — (Default) As soon as a flaw is found on a web server by a script, Tenable Nessus stops and switches to another web server on a different port.
• Stop after one flaw is found per parameter (slow) — As soon as one type of flaw is found in a parameter of a CGI (for example, XSS), Tenable Nessus switches to the next parameter of the same CGI, the next known CGI, or to the next port or server.
• Look for all flaws (slowest) — Perform extensive tests regardless of flaws found. This option can produce a very verbose report and is not recommend in most cases.

If enabled, the sensor queries domain users instead of local users. Enabling this setting allows plugins 10892 and 10398 to run and plugins 72684 and 10907 to query domain users.

You can enable as many of the user enumeration methods as appropriate for user discovery.

A text file that contains a list of known bad IP addresses that you want to detect.

Each line in the file must begin with an IPv4 address. Optionally, you can add a description by adding a comma after the IP address, followed by the description. You can also use hash-delimited comments (e.g., #) in addition to comma-delimited comments.

Note: Tenable does not detect private IP ranges in the text file.

You can upload any additional bad MD5 hashes via a text file that contains one MD5 hash per line. Optionally, you can include a description for a hash by adding a comma after the hash, followed by the description. If Tenable Nessus finds any matches while scanning a target, the description appears in the scan results. You can use standard hash-delimited comments (for example, #) in addition to the comma-separated comments.

Tenable Nessus checks system hosts files for signs of a compromise (for example, Plugin ID 23910 titled Compromised Windows System (hosts File Check). This option allows you to upload a file containing a list of IPs and hostnames that Tenable Nessus will ignore during the scan. Include one IP and one hostname (formatted identically to your hosts file on the target) per line in a regular text file.

A .yar file containing the YARA rules to be applied in the scan. You can only upload one file per scan, so include all rules in a single file. For more information, see yara.readthedocs.io.

Enabling this option allows you to scan system directories and files on host computers.

Caution: Enabling this setting in scans targeting 10 or more hosts could result in performance degradation.

When enabled, if at least one host credential and one Oracle database credential are configured, the scanner authenticates to scan targets using the host credentials, and then attempts to detect Oracle System IDs (SIDs) locally. The scanner then attempts to authenticate using the specified Oracle database credentials and the detected SIDs.

If the scanner cannot authenticate to scan targets using host credentials or does not detect any SIDs locally, the scanner authenticates to the Oracle database using the manually specified SIDs in the Oracle database credentials.