Red Hat NETWORK BASIC - USER REFERENCE GUIDE 4.0 Guida Utente Scaricare il pdf (Pagina 61)

timed-dependency

With this keyword, the functionality of the “noplugin” and “dependency” keywords is

slightly modified such that the evaluation must have occurred within the last “n” seconds.

udp

All plugins are assumed to be based on the TCP protocol unless this keyword is specified.

In addition to tcp or udp, the following protocols are supported: sctp, icmp, igmp, ipip, egp, pup, idp, tp, rsvp,

gre, pim, esp, ah, mtp, encap, pim, comp, raw or other.

Plugin Libraries

When writing PVS plugins in a .prm library, spaces are allowed, as are comment fields that start with a number ( # ) sign.

Each plugin must be separated with the word “NEXT” on a single line.

Simply creating a .prm file in the plugins directory will make it available for use. PVS must be restarted for the new

plugins to be used.

Basic Passive Vulnerability Scanner Example

This plugin illustrates the basic concepts of PVS plugin writing:

id=1001

nid=11414

hs_sport=143

name=IMAP Banner

description=An IMAP server is running on this port. Its banner is :\n %L

risk=NONE

match=OK

match=IMAP

match=server ready

regex=^.*OK.*IMAP.*server ready

In this example, the following fields are used:

 id is a unique number assigned to this plugin

 nid is the Nessus ID of the corresponding Nessus NASL script

 hs_sport is the source port to key on if we have the high-speed mode enabled

 name is the name of the plugin

 description is a description of the problem or service

 match is the set of match patterns we must find in the payload of the packet before we evaluate the regular

expression

 regex is the regular expression to apply to the packet payload

Notice that the description contains the %L macro. If this plugin evaluates successfully then the string pattern in the

payload that matched the regular expression is stored in %L and is printed out at report time.

More Complex Passive Vulnerability Scanner Example

id=1004

1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 78 79

Nessun commento

Red Hat NETWORK BASIC - USER REFERENCE GUIDE 4.0 Guida Utente Pagina 61