The SATAN User Interface

Subsections in the User Interface section:

• The Basics
• Data Management
• Gathering Data
• Looking at and understanding the results
• Hints, Further tricky security implications, or Getting The Big Picture (tm)
• The Command-line Interface

The Basics

This part of the documentation covers some of the basic design concepts and how to move around the SATAN user interface. However, with the exception of the target acquisition part of the program (we don't want you to learn how to probe hosts by trial and error!), the best way to learn how to use the program is to simply start pointing and clicking with your mouse or with the arrow keys on your keyboard.

Data Management

All of SATAN's data collection output will go to the current set of databases, which are kept in the results directory in a subdirectory that has the current database name. A default database, called satan-data will be automatically created if no other name is chosen.

If you choose the SATAN Data Management from the SATAN Control Panel, you have three choices; open an existing set of data, start a new database, or to merge the contents of an on-disk database with the in-core data.

Note! Opening or creating a new database will destroy all other in-core information from other databases or scans. For this reason it is a good idea to choose a database before collecting data. All queries will go to the in-core database. New data collection results, etc. will go into the currently selected on-disk database.

Merging a database concatenates the contents of the chosen on-disk database to the in-core information. Although care must be taken to have enough physical memory to contain all the databases, SATAN becomes more and more interesting as more information is combined, because more correlation, trust, and patterns can be detected. In addition, when large databases from different but connected (users log in from one site to another, or important data is being shared) sites are placed together, better information can be gotten for both sites. If you know friendly neighboring system administrators, instead of asking for permission to scan their site, exchange your latest SATAN database with each other, and help each other out. It would be interesting to put together hundreds of thousands of hosts from the Internet and see what happens (although the memory and CPU speed required to process this amount of data would be formidable!)

Gathering Data

The easiest and safest way to gather it is by simply selecting a target host that you'd like to know more about and then probe that host (and the subnet as well, if you wish) with the default settings: no host-to-subnet expansion, and a maximum proximity level of zero (see the config/satan.cf (SATAN configuration) file for more on this.)

See the tutorial on how to scan a target for the first time.

Looking at and understanding the results

1. Vulnerabilities. This is what most people think of when they think of SATAN - what/where are the weak points of the host/network.
2. Host Information. Very valuable information - this can show where the servers are, what the important hosts are, breakdown the network into subnets, organizational domains, etc. In addition, you can query about any individual host here.
3. Trust. SATAN can follow the web of trust between systems - trust through remote logins, trust by sharing file systems.

There are three basic ways of looking at the vulnerability results of your scan:

• Approximate Danger Level. All of the probes generate a basic level of danger if they find a potential problem; this sorts all the problems by severity level (e.g. the most serious level compromises root on the target host, the least allows an unprivileged file to be remotely read.)
• Type of Vulnerability. This simply shows all the types of vulnerabilities found in the probe, plus a corresponding list of hosts that fall under that vulnerability.
• Vulnerability Count. This shows which hosts have the most problems, by sheer number of vulnerabilities found by the probe.

Host Information

An enormous amount of information can be gained by examining the various subcategories of this section - remember, the more intensive the SATAN probe, the more information will be gathered. Typically this will show either the numbers of hosts that fall under the specific category with hypertext links to more specific information about the hosts or the actual list of hosts (which can be sorted into different orders on the fly). If there is a host listed with a red dot () next to it, that means the host has a vulnerability that could compromise it. Note that if SATAN reports a problem, it means the problem is possibly present. The presence of Wietse's TCP wrapper, a packet filter, firewall, other security measures, or just incomplete information or assumptions may mean that what SATAN "sees" is not the real picture. A black dot () means that no vulnerabilities have been found for that particular host yet. Note that a black dot next to the host does NOT mean that the host has no security holes. It only means that SATAN didn't find any; scanning at a higher level or additional probes might find some further information, and examining the SATAN database to see if probes were timing out rather than failing might mean the probes should be run a second time. Clicking on links will give you more information on that host, network, piece of information, or vulnerability, just as expected.

The categories are:

• Class of Service. This shows the various network services that the collected group of probed hosts offer - anonymous FTP, WWW, etc. Gathered by examining information garnered by rpcinfo and by scanning TCP ports.
• System Type. Breaks down the probed hosts by the hardware type (Sun, SGI, Ultrix, etc.); this is further subdivided by the OS version, if possible to ascertain. This is inferred by the various network banners of ftp, telnet, and sendmail.
• Internet Domain. Shows the various hosts broken down into DNS domains. This is very useful when trying to understand which domains are administered well or are more important (either by sheer numbers or by examining the numbers of servers or key hosts, etc.)
• Subnet. A subnet (as far as SATAN is concerned) is a block of up to 256 adjacent network addresses, all within the last octet of the IP address. This is the most common way of breaking up small organizations, and can be useful for showing the physical location or concentration of hosts in larger systems.
• Host name. Allows a query of the current database of probe information about a specific host.

Trust

This is a way of finding out the most important hosts on the network; the more hosts that trust a host (e.g. depend on some service, have logged in from the host, etc.), the more interesting it is to break-in from the outside, for once broken into an intruder could either break into or at least have a much better chance to break into the dependent hosts as well.

Hints, Further Tricky Security Implications, or Getting the Big Picture

• Probe your own hosts from an EXTERNAL site! This is a necessity for firewalls, and a very good idea for sites in general.
• Probe your hosts as heavily as possible, and use a high $proximity_descent value (2 or 3 are good.)
• Use a very low $max_proximity_level - it is almost never necessary to use more than 2. However, if you're behind a firewall (e.g. have no direct IP connectivity from the host that is running the SATAN scan (Be VERY careful if you're running SATAN behind a firewall that allows inside users to have direct IP connectivity to hosts on the Internet! You are essentially on the Internet as far as SATAN is concerned), you can set this higher. There should be almost no reason to ever set this to anything beyond single digits.
• Start with light probes and probe more heavily when you see potential danger spots. Keep tight control over what you scan - don't scan other people's hosts without permission!
• Use the $only_attack_these and $dont_attack_these variables to control where your attacks are going.
• Collect all of your user's .rhosts files and make a list of all external hosts found there. Get permission from the system administrators of those remote sites and run SATAN against all of them.
• If you have a host that a lot of other hosts trust or have critical hosts, make sure that you scan these hosts with a "heavy" scan to help ensure that no one can gain access to these. Unless politically impossible, scan the entire subnet of these key hosts as well, because once on a subnet, it's very easy to break into other hosts on the same subnet.

The Command-line Interface

Here are the command line options, what they do, and what SATAN variables they correspond to. Further explanations of the variables that are mentioned here can be found in the config/satan.cf (SATAN configuration) file.

SATAN enters interactive mode when no target host is specified.

-a

Attack level (0=light, 1=normal, 2=heavy). Variable: $attack_level.

-c 'name = value; name = value...'

Change SATAN variables. Use this to overrule configuration variables that do not have their own command-line option.

-d

SATAN database to read already collected data from, and to save new data to. Variable: $satan_data.

-i

Ignore already collected data.

-l

Maximal proximity level. Variable: $max_proximity_level.

-o list

Scan only these hosts, domains or networks. Variable: $only_attack_these.

-O list

Don't scan these hosts, domains or networks. Variable: $dont_attack_these.

-s

Enable subnet expansions. Variable: $attack_proximate_subnets.

-S status_file

SATAN status file (default status_file). Variable: $status_file.

-t level

Timeout length (0 = short, 1 = medium, 2 = long). Variable: $timeout.

-v

Turn on debugging output (to stdout). Variable: $debug.

-V

Print version number and terminate.

-z

Continue with attack level of zero when the level would become negative. The scan continues until the maximal proximity level is reached.

-Z

Opposite of the -z option.