Nessus is a vulnerability scanning program. Its goal is to detect potential vulnerabilities on the tested systems.

learn more… | top users | synonyms

1
vote
1answer
391 views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flagging 'High risk with sig 74326' after the latest rule updates to all HP iLO cards. This is specifically about the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears ...
4
votes
2answers
61 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
1
vote
2answers
179 views

How to scan printers on Nessus?

When I try to scan a printer with Nessus 4.4.1 I got the following message: Do not scan printers The remote host appears to be a fragile device and will not be scanned. How can I enable ...
-1
votes
1answer
41 views

Nessus HTML5 version 5.0.3 - PCI Scan [closed]

I've been searching for a couple days (and even contacted their support) to find out if Nessus (company is Tenable) has a bundle that scans for PCI compliance. The one that they gave me is the same as ...
0
votes
2answers
630 views

Nessus Security Vulnability Fix: SSL Version 2 (v2) Protocol Detection

Below, in quotes, is a medium severity issue discovered after scanning an IIS web server, with a tool called Nessus. "Consult the application's documentation to disable SSL 2.0 and use SSL 3.0, TLS ...
-4
votes
2answers
244 views

Crack http basic auth password from Linux [closed]

I have a network camera, where the default password does not work. It is probably something simple though, so I though I should try a stock password breaker. What should I use to try to crack my ...
0
votes
1answer
3k views

How to fix “TCP/IP Sequence Prediction Blind Reset Spoofing DoS”

Just finished a Nessus scan and the only thing that came back was "TCP/IP Sequence Prediction Blind Reset Spoofing DoS" - It may be possible to send spoofed RST packets to the remote system. ...
1
vote
1answer
2k views

PCI scan failure for SSL Certificate with Wrong Hostname?

A client had a PCI scan completed by SecurityMetrics, and it now says they failed due to the SSL certificate for the SMTP port 25 (and POP3s/IMAPS) not matching the domain scanned. Specifically: ...
1
vote
1answer
286 views

openVAS scan against new instance fails test (possible false positive) How to debug plug-in

I have openVAS installed from the atomic corp YUM repo, and it all seems to be functioning wonderfully, however I am seeing a single "Security Hole" which is that OpenVAS detects that "arora" is ...
2
votes
2answers
797 views

Using Credentials with network scanners

I'm testing out both Tenable's Nessus scanner as well as eEye's Retina for scanning network devices. I am trying to supply credentials to get deeper, more accurate results, however there seems to be ...