Two Vulnerability Scanning Tools Evaluated
By Bozidar Spirovski, CISSP, MCSA, MCP
We have mentioned our favorite vulnerability scanning tools before.
But a lot of time has passed since, so it is time to put these tools against each other and evaluate the quality of the results received when scanning the same target.
The Test Environment
The tested vulnerability scanning tools were installed on a Windows 7 Pro PC.
- Nessus server and client were installed and updated to the latest plugins.
- Retina 5.10.18.2135 Evaluation version was downloaded and installed. The Evaluation version does not allow updates, so we used what updates are included in the build.
The target was Damn Vulnerable Linux (DVL) version 1.5 installed as a VMWARE host with bridged networking on the same host PC as the vulnerability scanning tools.
The network of the DVL target was bridged, and all firewalls (both of the host OS and the guest OS) were disabled.
The DVL was started with the following services, with default settings and content as included in the distro.
- MySQL
- HTTP
- IPP Printer sharing which was active by default
The Scanning Process
Both scanners were started with setting on full port scan, with disabled safety of scanning, and all available plugins were activated.
Performance
- The Nessus scanner took more then 88 minutes to complete the scan
- The Retina scanner took 38 minutes to complete the scan
Results
- Both scanners failed to identify the target operating system
- The Nessus scanner identified the expected open ports, concluded that MySQL does not accept connections from unauthorized IP’s. On the Web server, it identified a significant number of vulnerabilites, and collected information from HTTP through web mirroring. On a repeat scan, it regenerated the same results
- You can download the full report of the Nessus Scan Here
- The Retina scanner identified HTTP and TCP port 631 (IPP Printer Sharing). It did not identify the MySQL port as open. On the Web server, it identified a significant number of vulnerabilites, but did not collect any information from the HTTP server. On a repeat scan it missed the HTTP port and only identified the MySQL port.
- You can download the full report of the Retina Scan Here
Conclusions
Both scanners performed a very well vulnerability identification but missed the OS identification. Also, both manifested flaws:
- Nessus missed the IPP port every time
- Retina manifested erroneous scan results, identifying different ports and vulnerabilities during different sessions - while no configuration changes were made to the test environment.
In terms of speed, Retina performed much faster. In terms of scan depth, Nessus has a small advantage, since it includes a web mirroring tool that is very helpful in HTTP.
It can be clearly concluded that these tools cannot be used as the sole source of information when performing a vulnerability test.
One must also utilize network mapping (NMAP, LanGuard), OS identification (NMAP) and specific application vulnerability scanners (ParosProxy, WebScarab for Web) for maximum effect.
In a direct comparison, Nessus wins simply because Retina manifested erroneous results on repeat scans.
* * *
Stay Informed With ISR News Alerts:
* * *
Author: Bozidar Spirovski of Information Security Short Takes
- Occupation: Information Security Expert
- CISSP #301565
- MCSA, MCP ID# 2448347
- Send comments, requests or general inquiry to shortinfosec _at_ gmail dot com
- Visit my LinkedIn profile at http://www.linkedin.com/in/spirovskibozidar
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
November 4th, 2009 at 12:08 pm
This article fails to deliver any depth or insight about Nessus or Retina. There’s plenty of opportunity for the author to share his expertise like explaining the usefulness of the web mirroring tool or illustrating how successive Retina scans produced erroneous results. As someone who uses Retina frequently, I’d like to be aware of any faults it has.