Assessment Settings in Tenable Vulnerability Management Scans

In some cases, Tenable Vulnerability Management cannot remotely determine whether a flaw is present or not. If report paranoia is set to Show potential false alarms, a flaw is reported every time, even when there is a doubt about the remote host being affected. Conversely, a paranoia setting of Avoid potential false alarms causes Tenable Vulnerability Management to not report any flaw whenever there is a hint of uncertainty about the remote host. As a middle ground between these two settings, disable this setting.

Tenable Vulnerability Management attempts to send spam through each SMTP device to the address listed in this field. This third party domain address must be outside the range of the site being scanned or the site performing the scan. Otherwise, the test may be aborted by the SMTP server.

The test messages sent to the SMTP server(s) appear as if the messages originated from the address specified in this field.

Tenable Vulnerability Management attempts to send messages addressed to the mail recipient listed in this field. The postmaster address is the default value since it is a valid address on most mail servers.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Specifies which type of web browser Tenable Vulnerability Management impersonates while scanning.

/

The URL of the first page that is tested. If multiple pages are required, use a colon delimiter to separate them (e.g., /:/php4:/base).

Specifies portions of the web site to exclude from being crawled. For example, to exclude the /manual directory and all Perl CGI, set this field to: (^/manual) <> (\.pl(\?.*)?$).

Tenable Vulnerability Management supports POSIX regular expressions for string matching and handling, as well as Perl-compatible regular expressions (PCRE).

1000

The maximum number of pages to crawl.

6

Limit the number of links Tenable Vulnerability Management follows for each start page.

Disabled

If selected, Tenable Vulnerability Management follows dynamic links and may exceed the parameters set above.

This setting manages the combination of argument values used in the HTTP requests. The default, without checking this option, is testing one parameter at a time with an attack string, without trying non-attack variations for additional parameters. For example, Tenable Vulnerability Management would attempt
/test.php?arg1=XSS&b=1&c=1, where b and c allow other values, without testing each combination. This is the quickest method of testing with the smallest result set generated.

This setting has four options:

• Test random pairs of parameters: This form of testing randomly checks a combination of random pairs of parameters. This is the fastest way to test multiple parameters.
• Test all pairs of parameters (slow): This form of testing is slightly slower but more efficient than the one value test. While testing multiple parameters, it tests an attack string, variations for a single variable and then use the first value for all other variables. For example, Tenable Vulnerability Management would attempt /test.php?a=XSS&b=1&c=1&d=1 and then cycle through the variables so that one is given the attack string, one is cycled through all possible values (as discovered during the mirror process) and any other variables are given the first value. In this case, Tenable Vulnerability Management would never test for /test.php?a=XSS&b=3&c=3&d=3 when the first value of each variable is 1.
• Test random combinations of three or more parameters (slower): This form of testing randomly checks a combination of three or more parameters. This is more thorough than testing only pairs of parameters. Increasing the amount of combinations by three or more increases the web application test time.
• Test all combinations of parameters (slowest): This method of testing checks all possible combinations of attack strings with valid input to variables. Where all pairs testing seeks to create a smaller data set as a tradeoff for speed, all combinations makes no compromise on time and uses a complete data set of tests. This testing method may take a long time to complete.
  

This setting determines when a new flaw is targeted. This applies at the script level. Finding an XSS flaw does not disable searching for SQL injection or header injection, but unless otherwise specified, there is at most one report for each type on a given port. Note that several flaws of the same type (for example, XSS or SQLi) may be reported if they were caught by the same attack.

If this option is disabled, as soon as a flaw is found on a web page, the scan moves on to the next web page.

If you enable this option, select one of the following options:

• Stop after one flaw is found per web server (fastest) — (Default) As soon as a flaw is found on a web server by a script, Tenable Vulnerability Management stops and switches to another web server on a different port.
• Stop after one flaw is found per parameter (slow) — As soon as one type of flaw is found in a parameter of a CGI (for example, XSS), Tenable Vulnerability Management switches to the next parameter of the same CGI, the next known CGI, or to the next port or server.
• Look for all flaws (slowest) — Perform extensive tests regardless of flaws found. This option can produce a very verbose report and is not recommend in most cases.

If enabled, domain users are queried instead of local users.

You can enable as many of the user enumeration methods as appropriate for user discovery.

A text file that contains a list of known bad IP addresses that you want to detect.

Each line in the file must begin with an IPv4 address. Optionally, you can add a description by adding a comma after the IP address, followed by the description. You can also use hash-delimited comments (e.g., #) in addition to comma-delimited comments.

Note: Tenable does not detect private IP ranges in the text file.

A text file with one MD5 hash per line that specifies additional known bad MD5 hashes.

Optionally, you can include a description for a hash by adding a comma after the hash, followed by the description. If any matches are found when scanning a target, the description appears in the scan results. You can also use hash-delimited comments (for example, fop) in addition to comma-delimited comments.

A text file with one MD5 hash per line that specifies additional known good MD5 hashes.

Optionally, you can include a description for each hash by adding a comma after the hash, followed by the description. If any matches are found when scanning a target, and a description was provided for the hash, the description appears in the scan results. You can also use hash-delimited comments (for example, #) in addition to comma-delimited comments.

Tenable Vulnerability Management checks system hosts files for signs of a compromise (for example, Plugin ID 23910 titled Compromised Windows System (hosts File Check)). This option allows you to upload a file containing a list of IPs and hostnames you want Tenable Vulnerability Management to ignore during a scan. Include one IP and one hostname (formatted identically to your hosts file on the target) per line in a regular text file.

A .yar file containing the YARA rules to be applied in the scan. You can only upload one file per scan, so include all rules in a single file. For more information, see yara.readthedocs.io.

If enabled, Tenable Vulnerability Management can scan system directories and files on host computers.

Caution: Enabling this setting in scans targeting 10 or more hosts could result in performance degradation.

When enabled, if at least one host credential and one Oracle database credential are configured, the scanner authenticates to scan targets using the host credentials, and then attempts to detect Oracle System IDs (SIDs) locally. The scanner then attempts to authenticate using the specified Oracle database credentials and the detected SIDs.

If the scanner cannot authenticate to scan targets using host credentials or does not detect any SIDs locally, the scanner authenticates to the Oracle database using the manually specified SIDs in the Oracle database credentials.