Assessment Scan Settings

Basic Network Scan

Basic Web App Scan

Internal PCI Network Scan

Four options are available:

• Scan for known web vulnerabilities
• Scan for all web vulnerabilities (quick)
• Scan for all web vulnerabilities (complex)
• Custom

Nessus attempts to send spam through each SMTP device to the address listed in this field. This third party domain address must be outside the range of the site being scanned or the site performing the scan. Otherwise, the test may be aborted by the SMTP server.

The test messages sent to the SMTP server(s) appear as if they originated from the address specified in this field.

Nessus attempts to send messages addressed to the mail recipient listed in this field. The postmaster address is the default value since it is a valid address on most mail servers.

The number of simultaneous Hydra tests that you want to execute. By default, this value is 16.

Start at Register

The register at which to start scanning.

Disabled

This option enables Nessus to take screenshots to better demonstrate some findings. This includes some services (e.g., VNC, RDP) as well as configuration specific options (e.g., web server directory indexing). The feature only works for internet-facing hosts, as the screenshots are generated on a managed server and sent to the Nessus scanner.

Screen shots are not exported with a Nessus scan report.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Specifies which type of web browser Nessus impersonates while scanning.

/

The URL of the first page that is tested. If multiple pages are required, use a colon delimiter to separate them (e.g., /:/php4:/base).

Specifies portions of the web site to exclude from being crawled. For example, to exclude the /manual directory and all Perl CGI, set this field to: (^/manual) <> (\.pl(\?.*)?$).

Nessus supports POSIX regular expressions for string matching and handling, as well as Perl-compatible regular expressions (PCRE).

1000

The maximum number of pages to crawl.

6

Limit the number of links Nessus follows for each start page.

Disabled

If selected, Nessus follows dynamic links and may exceed the parameters set above.

This setting manages the combination of argument values used in the HTTP requests. The default, without checking this option, is testing one parameter at a time with an attack string, without trying non-attack variations for additional parameters. For example, Nessus would attempt
/test.php?arg1=XSS&b=1&c=1, where b and c allow other values, without testing each combination. This is the quickest method of testing with the smallest result set generated.

This setting has four options:

• Test random pairs of parameters: This form of testing randomly checks a combination of random pairs of parameters. This is the fastest way to test multiple parameters.
• Test all pairs of parameters (slow): This form of testing is slightly slower but more efficient than the one value test. While testing multiple parameters, it tests an attack string, variations for a single variable and then use the first value for all other variables. For example, Nessus would attempt /test.php?a=XSS&b=1&c=1&d=1 and then cycle through the variables so that one is given the attack string, one is cycled through all possible values (as discovered during the mirror process) and any other variables are given the first value. In this case, Nessus would never test for /test.php?a=XSS&b=3&c=3&d=3 when the first value of each variable is 1.
• Test random combinations of three or more parameters (slower): This form of testing randomly checks a combination of three or more parameters. This is more thorough than testing only pairs of parameters. Increasing the amount of combinations by three or more increases the web application test time.
• Test all combinations of parameters (slowest): This method of testing checks all possible combinations of attack strings with valid input to variables. Where all pairs testing seeks to create a smaller data set as a tradeoff for speed, all combinations makes no compromise on time and uses a complete data set of tests. This testing method may take a long time to complete.
  

This setting determines when a new flaw is targeted. This applies at the script level. Finding an XSS flaw does not disable searching for SQL injection or header injection, but unless otherwise specified, there is at most one report for each type on a given port. Note that several flaws of the same type (e.g., XSS, SQLi, etc.) may be reported if they were caught by the same attack.

This setting has three options:

• Stop after one flaw is found per web server (fastest): As soon as a flaw is found on a web server by a script, Nessus stops and switches to another web server on a different port.
• Stop after one flaw is found per parameter (slow): As soon as one type of flaw is found in a parameter of a CGI (e.g., XSS), Nessus switches to the next parameter of the same CGI, the next known CGI, or to the next port or server.
• Look for all flaws (slowest): Perform extensive tests regardless of flaws found. This option can produce a very verbose report and is not recommend in most cases.

If enabled, domain users are queried instead of local users.

You can enable as many of the user enumeration methods as appropriate for user discovery.

A text file that contains a list of known bad IP addresses that you want to detect.

Each line in the file must begin with an IPv4 address. Optionally, you can add a description by adding a comma after the IP address, followed by the description. You can also use hash-delimited comments (e.g., #) in addition to comma-delimited comments.

Additional known bad MD5 hashes can be uploaded via a text file that contains one MD5 hash per line. Optionally, you can include a description for a hash by adding a comma after the hash, followed by the description. If any matches are found when scanning a target, the description appears in the scan results. Hash-delimited comments (e.g., #) can also be used in addition to the comma-delimited ones.

Nessus checks system hosts files for signs of a compromise (e.g., Plugin ID 23910 titled Compromised Windows System (hosts File Check)). This option allows you to upload a file containing a list of IPs and hostnames to be ignored by Nessus during a scan. Include one IP and one hostname (formatted identically to your hosts file on the target) per line in a regular text file.

A .yar file containing the YARA rules to be applied in the scan. You can only upload one file per scan, so include all rules in a single file. For more information, see yara.readthedocs.io.

Turning on this option allows you to scan system directories and files on host computers.

Caution: Enabling this setting in scans targeting 10 or more hosts could result in performance degradation.