Appendix A. Testing Data for Network Scanners in Various Operating Systems
|
A. RedHat Linux 7.2 (Enigma) 2.4.18 SMP
|
ISS
|
LanGuard
|
Nessus
|
NetRecon
|
Retina
|
MaxPatrol
|
|
Final points:
|
24.5
|
13
|
43.5
|
10
|
35.5
|
43
|
|
TOTAL vulnerability detections:
|
26
|
13
|
45
|
10
|
39
|
43
|
|
TOTAL false detections:
|
-1.5
|
0
|
-1.5
|
0
|
-3.5
|
0
|
|
Vulnerabilities detected
|
|
Vulnerability Apache Chuncked at port 80 (+3)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Vulnerability Apache Chuncked at port 443 (+3)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in mod_ssl at port 80 (+3)
|
|
Ö
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in mod_ssl at port 443 (+3)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in OpenSSL at port 80 (+3)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in OpenSSL at port 443 (+3)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Memory leak "scoreboard" in Apache at port 80 (+2)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Memory leak "scoreboard" in Apache at port 443 (+2)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in «Timing based» in Apache at port 80 (+2)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Vulnerability in «Timing based» in Apache at port 443 (+2)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Multiple vulnerabilities in PHP in Apache at port 80 (+2)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Multiple vulnerabilities in PHP in Apache at port 443 (+2)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Retrieving /index.php.old file content (+2)
|
|
|
Ö
|
|
|
|
|
Retrieving list of NetBIOS resources (+2)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Retrieving list of NetBIOS users (+2)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Detection of login and password guest/guest at port 2021 in FTP (+2)
|
|
|
|
|
|
Ö
|
|
Retrieving the list of directories in Apache at port 80 (+1)
|
|
|
Ö
|
|
|
Ö
|
|
Retrieving the list of directories in Apache at port 443 (+1)
|
|
|
Ö
|
|
|
Ö
|
|
Support for TRACE method by Apache service at port 80 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
Support for TRACE method by Apache service at port 443 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
HTTP identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
HTTPS identification (+1)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
SSH identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
FTP identification at port 2021 (+1)
|
|
|
Ö
|
|
|
Ö
|
|
MySQL identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Ö
|
|
False detections
|
|
Presence of empty NetBIOS passwords (-1.5)
|
|
|
Ö
|
|
Ö
|
|
|
Overflow in 'rwhod' service (-1.5)
|
Ö
|
|
|
|
|
|
|
Viewing directories content in Apache at port 80 (-1)
|
|
|
|
|
Ö
|
|
|
Viewing directories content in Apache at port 443 (-1)
|
|
|
|
|
Ö
|
|
|
B. Windows XP Professional
|
ISS
|
LanGuard
|
Nessus
|
NetRecon
|
Retina
|
MaxPatrol
|
|
Final points:
|
8.5
|
10
|
8
|
7
|
8.5
|
20
|
|
TOTAL vulnerability detections:
|
10
|
10
|
14
|
8
|
10
|
20
|
|
TOTAL false detections:
|
-1.5
|
0
|
-6
|
-1
|
-1.5
|
0
|
|
Vulnerabilities detected
|
|
No password for SA user in MS SQL Server (+3)
|
Ö
|
Ö
|
Ö
|
|
Ö
|
Ö
|
|
Overflow in UPnP service (+3)
|
|
|
|
Ö
|
|
Ö
|
|
Permission to write in IIS Server directories (+3)
|
|
|
|
|
|
Ö
|
|
Permission to view contents of directory /cgi-bin in IIS Server (+2)
|
|
|
|
|
|
Ö
|
|
Retrieving list of NetBIOS resources (+2)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Enabled WebDAV at IIS Server (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
Support of method TRACE in IIS Server service (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
Retrieving list of unavailable directories in IIS Server (+1)
|
|
|
Ö
|
|
|
Ö
|
|
IIS Server identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
MS SQL identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
MS RDP identification (+1)
|
|
Ö
|
Ö
|
|
Ö
|
Ö
|
|
NTP identification (+1)
|
Ö
|
Ö
|
Ö
|
|
|
Ö
|
|
UPnP identification (+1)
|
|
Ö
|
Ö
|
Ö
|
|
Ö
|
|
RPC services identification (+1)
|
|
|
Ö
|
|
|
Ö
|
|
False detections
|
|
Overflow in /_vti_bin/_vti_aut/dvwssr.dll in Microsoft UPnP TCP helper (-1.5)
|
|
|
Ö
|
|
|
|
|
Empty passwords in NetBIOS (-1.5)
|
|
|
Ö
|
|
|
|
|
Presence of vulnerable script upload.cgi (-1.5)
|
|
|
Ö
|
|
|
|
|
Overflow in PROPFIND query at IIS Server (-1.5)
|
|
|
Ö
|
|
|
|
|
HTTP Header overflow in ISS Server (-1.5)
|
Ö
|
|
|
|
Ö
|
|
|
Presence of vulnerable qfullhit.htw (-1)
|
|
|
|
Ö
|
|
|
|
C. Windows 2000 Server
|
ISS
|
LanGuard
|
Nessus
|
NetRecon
|
Retina
|
MaxPatrol
|
|
Final points:
|
13
|
4
|
13.5
|
1.5
|
10
|
29
|
|
TOTAL vulnerability detections:
|
13
|
4
|
15
|
3
|
10
|
29
|
|
TOTAL false detections:
|
0
|
0
|
-1.5
|
-1.5
|
0
|
0
|
|
Vulnerabilities detected
|
|
ASSA password for SA user in MS SQL Server (+3)
|
|
|
|
|
|
Ö
|
|
No password in Radmin at port 4898 (+3)
|
|
|
|
|
|
Ö
|
|
DoS attacks in Apache (+3)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Buffer overflow in RPC service at port 1026 (+2)
|
|
|
|
|
|
Ö
|
|
Writing files to any location at server over TFTP using PUT /../../../../file.txt command (+2)
|
|
|
|
|
|
Ö
|
|
Viewing files in Apache (+2)
|
Ö
|
|
Ö
|
|
|
Ö
|
|
XSS in Apache (+2)
|
Ö
|
|
|
|
Ö
|
Ö
|
|
Support for TRACE method in Apache service (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
Apache identification at port 81 (+1) (+1)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Retrieving directory list in Apache (+1)
|
|
|
Ö
|
|
|
Ö
|
|
MsSQL identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
MS RDP identification (+1)
|
|
Ö
|
Ö
|
|
Ö
|
Ö
|
|
NTP identification (+1)
|
Ö
|
Ö
|
Ö
|
|
|
Ö
|
|
Radmin identification at port 4898 (+1)
|
|
|
|
|
|
Ö
|
|
Radmin identification at port 4899 (+1)
|
|
|
Ö
|
|
|
Ö
|
|
TFTP identification (+1)
|
|
Ö
|
|
Ö
|
|
Ö
|
|
ICQ Server identification (+1)
|
Ö
|
|
|
|
|
Ö
|
|
DNS identification (+1)
|
Ö
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
MS DTC identification (+1)
|
|
|
Ö
|
|
|
Ö
|
|
RPC services identification (+1)
|
|
|
Ö
|
|
|
Ö
|
|
False detections
|
|
Overflow in MS SQL Server (-1.5)
|
|
|
|
Ö
|
|
|
|
Overflow in Tomcat Servlet engine (-1.5)
|
|
|
Ö
|
|
|
|
|
Overflow in MS SQL Server (-1.5)
|
|
|
|
Ö
|
|
|
|
D. Sun Solaris 7 (SPARC)
|
ISS
|
LanGuard
|
Nessus
|
NetRecon
|
Retina
|
MaxPatrol
|
|
Final points:
|
11
|
8
|
18.5
|
10
|
18
|
20.5
|
|
TOTAL vulnerability detections:
|
11
|
8
|
19
|
12
|
19
|
22
|
|
TOTAL false detections:
|
0
|
0
|
-0.5
|
-2
|
-1
|
-1.5
|
|
Vulnerabilities detected
|
|
Remote command execution because of FTP vulnerability at port 21 (+3)
|
|
Ö
|
Ö
|
|
Ö
|
Ö
|
|
Format string vulnerability in FTP at port 21 (+3)
|
|
|
|
Ö
|
Ö
|
|
|
Vulnerability SSH CRC-32 Compensation Attack at port 22 (+3)
|
Ö
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Miscellaneous buffer overflows in BIND service at port 53 (+3)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
Buffer overflow in 'dmispd' service at port 32772 (+3)
|
|
|
|
|
|
Ö
|
|
Not logged password guess in SSH at port 22 (+2)
|
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
Recursion enabled in BIND service at port 53 (+2)
|
|
|
Ö
|
|
|
Ö
|
|
Support for TRACE method in Apache service at port 80 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
HTTP identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
FTP identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
SSH identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
DNS identification (+1)
|
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
RPC Unix identification (+1)
|
|
|
|
|
|
Ö
|
|
NTP identification (+1)
|
Ö
|
Ö
|
Ö
|
|
|
Ö
|
|
False detections
|
|
Buffer overflow in 'status' service at port 32771 (-1.5)
|
|
|
|
|
|
Ö
|
|
Permission for EXPN command execution in SMTP (-1.0)
|
|
|
|
|
Ö
|
|
|
SMTP identification (-0.5)
|
|
|
|
Ö
|
|
|
|
Possibility to verify users using RCPT TO command in SMTP (-1.0)
|
|
|
|
Ö
|
|
|
|
PortMap identification at port 32771 (-0.5)
|
|
|
|
Ö
|
|
|
|
Detection of antivirus software in SMTP (-0.5)
|
|
|
Ö
|
|
|
|
|
E. Windows 2000 Server
with "mapped" ports
|
ISS
|
LanGuard
|
Nessus
|
NetRecon
|
Retina
|
MaxPatrol
|
|
Final points:
|
10
|
2.5
|
11.5
|
4
|
9.5
|
19
|
|
TOTAL vulnerability detections:
|
14
|
4
|
18
|
6
|
11
|
19
|
|
TOTAL false detections:
|
-4
|
-1.5
|
-6.5
|
-2
|
-1.5
|
0
|
|
Vulnerabilities detected
|
|
Recursion enabled in BIND service at port 53 (+2)
|
|
|
Ö
|
|
|
Ö
|
|
'FTP bounce' vulnerability at port 21 (+2)
|
Ö
|
|
Ö
|
|
|
Ö
|
|
Support of TRACE method in Apache service at port 80 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
|
|
HTTP identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
HTTPS identification (+1)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
FTP identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
SSH identification at port 22 (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
SSH identification at port 24 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
SSH identification at port 222 (+1)
|
Ö
|
|
Ö
|
|
Ö
|
Ö
|
|
DNS identification (+1)
|
Ö
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
SMTP identification (+1)
|
Ö
|
|
Ö
|
Ö
|
Ö
|
Ö
|
|
POP3 identification (+1)
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
Ö
|
|
POP3s identification (+1)
|
|
|
Ö
|
|
Ö
|
Ö
|
|
Radmin identification (+1)
|
Ö
|
|
Ö
|
|
|
Ö
|
|
IRC identification at port 5190 (+1)
|
|
|
|
|
|
Ö
|
|
IRC identification at port 6667 (+1)
|
Ö
|
|
Ö
|
|
|
Ö
|
|
Kerio identification (+1)
|
|
|
|
|
|
Ö
|
|
IRC identification at port 61234 (+1)
|
|
|
Ö
|
|
|
Ö
|
|
False detections
|
|
Multiple vulnerabilities in non-existent Wu-FTP at port 21 (-1.5)
|
|
Ö
|
|
|
Ö
|
|
|
Buffer overflow in field MAIL FROM in SMTP (-1.5)
|
|
|
Ö
|
|
|
|
|
Buffer overflow in field ETRN in SMTP (-1.5)
|
Ö
|
|
Ö
|
|
|
|
|
Buffer overflow in FTP (-1.5)
|
Ö
|
|
|
|
|
|
|
DoS attack with AUX query in FTP (-1.5)
|
|
|
Ö
|
|
|
|
|
Viewing configuration files at web server at port 443 (-1.0)
|
|
|
Ö
|
|
|
|
|
Presence of user accounts with standard passwords in FTP (-1.0)
|
Ö
|
|
Ö
|
Ö
|
|
|
|
Ability to verify users using RCPT TO command in SMTP (-1.0)
|
|
|
|
Ö
|
|
|
Considering the artificial (but illustrative) nature of this test, it was not included in final calculations.
