What is Internet Scanner?

Internet Scanner is the fastest, most comprehensive, and most proactive network security scanner available. It configures easily, scans quickly, and produces comprehensive reports. This version of Internet Scanner runs under Microsoft® Windows NT® 4.0 Workstation.

Internet Scanner investigates and analyzes your network environment for selected security vulnerabilities, simulating the techniques of skilled vulnerability analysts and Network Security Engineers. Depending on the reporting options you select, Internet Scanner gives you information about each detected vulnerability, including its location, detailed description, and suggested corrective actions.

Internet Scanner can be used on all TCP/IP-based networks—networks connected to the Internet, in addition to stand-alone networks and machines.

Internet Scanner should be run periodically. Test the security of network devices and the integrity of the network on a regular basis to detect newly introduced weaknesses and changes in the network. A potential threat from internal sources means that your network should be secure from both internal and external dangers.

How do I use Internet Scanner?

Using Internet Scanner on a day-to-day basis involves:

  • Running scans of the network. You can run scans from the user interface or from the command line. You can also schedule the scan to run unattended.

  • Analyzing the results. You can analyze the results of scans by creating and examining a variety of reports generated by Internet Scanner or your custom applications.

More Information about Internet Scanner

Troubleshooting and References


What's New in Version 6.0

What’s New in this Version

New Feature

Description

Policy Editor

The new version of the Policy Editor arranges configurable properties in a folder tree, letting you sort, group, and browse through global settings, vulnerability checks, services, and accounts that you can enable for your policy. The folder tree settings include:

  • Common Settings,

  • FlexChecks™,

  • vulnerabilities (built-in exploits or plug-in exploits),

  • services (RPC, TCP, UDP, Windows NT), and

  • accounts (Finger, NetBIOS, RPC).

You can arrange the Policy Editor’s folder tree in four different views:

  • Built-Ins/Plug-Ins View

  • Category View

  • Risk View

  • Standard View

The Policy Editor also contains a browser-enabled window used for:

  • viewing information on each vulnerability check, such as the vulnerability’s description, the platforms affected by the vulnerability, the vulnerability’s risk level, the vulnerability’s remedy information, and additional reference information,

  • accessing external Web sites that may contain additional fix information, patches, or updates, and

  • linking you directly to the X-Force Knowledge Base.

This version of the Policy Editor replaces the tabbed Configuration dialog box that was used in Internet Scanner 5.x.

X-Press Updates™

X-Press Updates automatically update your system with the latest plug-in checks and the latest product updates available for Internet Scanner, without having to download and to re-install a new version of Internet Scanner.

X-Press Updates are available from a secure server on the ISS Web site, and can be installed on your system automatically via the Web using the X-Press Updates install program. Or, you can download the X-Press Updates from the ISS Web site using the X-Press Updates install program to your local directory or to a network share and then choose from either of those locations which updates you would like to install on your system.

For information on how to install X-Press Updates, view the X-Press Updates help file (XPressUpdate.chm) in the <Internet Scanner install directory>/Scanner6/XPressUpdate.

Subscribe to the X-Press Update Mailing Lists!—The X-Press Updates Mailing Lists at xpress@iss.net or xpress-binary@iss.net are e-mail forums, which provide information on X-Press Updates and automatically e-mail you when there are new X-Press Updates that you can install on your system.

Database Scanner Integration

Internet Scanner combines functions of Database Scanner to discover new database servers (Microsoft SQL Server, Oracle, or Sybase Adaptive Server) that have been deployed in your organization, and to assess the risk associated with those servers.

Internet Scanner 5.3 to 6.0 Migration Kit

Internet Scanner provides a command-line utility for easily moving your Unix vulnerability data and Unix scan policies to Windows NT. The migration kit executables, db2u.exe and u2db.exe, are located in the <Internet Scanner install directory>/Scanner6/Tools.

New Vulnerability Checks

Internet Scanner includes 65 new vulnerability checks, including more than 30 new checks for malicious backdoor programs (such as BackOrifice 2000) that attackers use to remotely control computers.

New Default Scan Policies

Internet Scanner includes many new default policies targeted towards specific operating systems, system types, or system use.

UDP Port Scanning

Internet Scanner sends a collection of UDP packets to the UDP port to check if it is active.

New Reports

In addition to many improvements to existing reports, Internet Scanner now includes Executive level reports in Italian and condensed Summary reports.


What are X-Press Updates?

X-Press Updates automatically update your system with the latest plug-in checks and the latest product updates available for Internet Scanner, without having to download and to re-install a new version of Internet Scanner. An update is a package that includes either an update to a component of Internet Scanner or a plug-in check that will be used with Internet Scanner.

Installing or downloading X-Press Updates

X-Press Updates are available from a secure Web server on the ISS Web site and can be:

  • installed on your system automatically via the Web using the X-Press Updates install program, or

  • downloaded to a local drive or to a network share using the X-Press Updates install program, and installed on your system from either of those locations, or

  • downloaded to a local drive or to a network share using the X-Press Updates install program, and installed on your system from either of those locations at a later time.

X-Press Updates Help

Before installing X-Press Updates, close Internet Scanner. For procedures on how to install or how to download X-Press Updates, see the .

Subscribe to the X-Press Updates Mailing Lists!

The X-Press Updates Mailing Lists at xpress@iss.net or xpress-binary@iss.net are e-mail forums, which provide information on X-Press Updates and automatically e-mail you when there are new X-Press Updates that you can install on your system.


Disclaimer

Copyright © 1999 by Internet Security Systems, Inc. All Rights Reserved.

The information contained in this document may change without notice, and may have been altered or changed if you have received it from a source other than ISS or the X-Force. Use of this information constitutes acceptance for use in an “AS IS” condition, without warranties of any kind, and any use of this information is at the user’s own risk. ISS and the X-Force disclaim all warranties, either expressed or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall ISS or the X-Force be liable for any damages whatsoever, including direct, indirect, incidental, consequential, or special damages, arising from the use or dissemination hereof, even if ISS or the X-Force has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Please send suggestions, updates, and comments to Internet Security Systems, Inc. at customer_connect@iss.net.


Year 2000 Readiness Disclosure Statement

To view ISS’ Year 2000 Readiness Disclosure Statement, go to http://www.iss.net/y2k.php3.


Getting Patch and Fix Information

In the Vulnerability Information window of the browser-enabled Policy Editor, you can look up specific vulnerabilities and get instructions for how to fix them. Web links are provided, where possible, to make it easy for you to go directly from the Policy Editor to the correct patch or Web page to resolve or get more information on the current issue.

Since Internet Scanner can be used in many different countries, it is not always possible to go directly to a non-US patch site. If you need non-US patches, they are generally available by navigating up a few directories from the link we provide (in the case of FTP sites), or accessing the vendor’s home page and navigating to the appropriate directory for your home country.

If you are not sure which version of a patch to use on your system, contact your vendor for assistance.

For technical support or more information about Internet security issues, refer to the following:

Technical Support

Telephone: (888) 447-4861 or (678) 443-6400

Hours: Monday-Friday 8 AM to 8 PM (EST)

E-mail: support@iss.net

Internet Sites

Security Mailing Lists

ISS maintains a number of Internet mailing lists on security-related topics. To discover what lists are available, or to sign up for one or more lists, see http://www.iss.net/vd/maillist.html.

ISS Security Library

ISS provides a wealth of site links, articles, presentations, and more at http://www.iss.net/vd/library.html.

Microsoft Patches

Domestic and international service packs for Windows systems are available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/.

CERT Advisories

The CERT Coordination Center compiles advisories related to computer security. Its home page is http://www.cert.org, and advisories are stored at ftp://ftp.cert.org/pub/cert_advisories/.

NT Security FAQ

This list provides answers to many questions about Windows NT security. It also includes numerous links to related security sites. It’s at http://www.it.kth.se/~rom/ntsec.html.

General Security FAQs

http://www.iss.net/vd/faq.html

http://www.alw.nih.gov/Security/


Introducing Views

Internet Scanner’s main window is divided into three sections, called Views. The Views display what is occurring as Internet Scanner scans your network. The Tree View and the List View at the top portion of the window are arranged in tabbed sections.

The Views are explained in detail in the following topics:

  • Tree View

  • List View

  • Status View


Tree View

The Tree View is the upper left portion of the Internet Scanner main window. It displays your network in four different modes that are available as tabs and icons along the bottom edge of the view. The following list of the four modes provides a detailed explanation:

Hosts

Vulnerabilities

Services

Accounts


List View

The List View is the upper right view of the Internet Scanner main window. It displays information about the IP addresses being probed by Internet Scanner. Selecting an item from any of the tabs in the Tree View at the left of the window displays detailed information in the List View at its right. Double-clicking on any IP address in the List View displays tabs at the bottom of the view. You can use these tabs to display more information about the machine. The following is a list of tabs you can select in the List View. Select a tab to display more information:

Properties

Status

Vulnerabilities

Services

Accounts


Status View

The Status View is located across the bottom of the Internet Scanner main window. It contains status information gathered during the course of a scan. There may be one or more tabs along the bottom of the Status View.

The General tab is always present, and displays the security status of the working and output directories at the beginning of a scan. It also displays informational messages and non-critical errors.

For each loaded session, a tab with that session’s name appears in the Status View. Messages accumulate in the Status View for that session when a host begins or finishes a scan. The messages also indicate when the entire scan started and ended.

If the scan settings require a response server, Internet Scanner also reports whether the servers were able to initialize.


Status Bar

The status bar appears at the bottom of the Internet Scanner main window. From left to right, it consists of these sections:

Status Bar Item | Description
Policy | The policy loaded for the current session.
Key | The key selected for the current session.
Hosts Scanned | Displays the total number of hosts in this scan.
Scan Progress | A bar chart displays how much of the scan is complete.


File Menu Commands

The following commands are available from the File menu:

New Session | Creates a new session.
Open | Opens a previously saved session from a file or from the Internet Scanner database.
Delete Session | Available only when no sessions are active. Lets you browse the file system and delete session files.
Close Session | Closes the current session.
Save Session | Saves the current scan session in the directory of your choice.
Save Session As | Saves the current session in the directory of your choice under a new name.
Export Host File | Saves hosts from the current session to a host’s file.
Recent Sessions | Allows the most recent sessions to be opened.
Exit | Exits the application.


Edit Menu Commands

The following commands are available from the Edit menu:

Add Host | Adds a host to the current scan session.
Remove Host | Deletes currently selected host or subnet tree.


View Menu Commands

The following commands are available from the View menu. This menu is not available if a session is not selected.

Toolbar | If checked, displays the toolbar at the top of the Internet Scanner main window.
Status Bar | If checked, displays the status bar.
Show All Hosts | If checked, displays all hosts in the Tree View.
Refresh | Updates current view.
Host Tree | Displays the Host tab in the Tree View.
Vulnerability Tree | Displays the Vulnerabilities tab in the Tree View.
Service Tree | Displays the Service tab in the Tree View.
Account Tree | Displays the Accounts tab in the Tree View.
Properties View | Displays the Properties tab in the List View.
Status View | Displays the Status tab in the List View.
Vulnerability View | Displays the Vulnerability tab in the List View.
Service View | Displays the Service tab in the List View.
Account View | Displays the Accounts tab in the List View.
Real Time Mode | Updates the Tree View and the List View in real time. Real-time mode is not recommended for large networks.
Session Data View | Displays session information as the scan takes place.
Display Key | Displays information about the session key.
Installed X-Press Modules | Displays information for each Resource Module and Exploit Module installed on the system.


Policy Menu Commands

The following commands are available from the Policy Menu:

New | Displays the New Policy dialog box.
Apply Existing | Displays the Select Policy dialog box.
Delete | Displays the Delete Policy dialog box.
Print | Displays the Print Policy dialog box used to print the policy summary for a scanned host. Each print summary can be sorted by exploit name, exploit class (category), or exploit risk level.
Edit Current | Displays the Policy Editor, which lists the exploits and settings enabled for the policy you would like to edit.
Properties | Displays the Properties dialog box, which lists the exploits enabled for a policy, and lets you set up permissions to edit or to delete a policy.


Scan Menu Commands

The following commands are available from the Scan menu:

Scan Now | Starts a scan on the currently selected host or hosts using the current policy.
Console Mode Scan | Starts a scan from the command line using the current policy. Eliminates the overhead associated with the user interface.
Pause Scan | Pauses the current scan.
Resume Scan | Resumes the current paused scan.
Stop Scan | Ends the current scan (use for emergencies only).


Report Menu Commands

Reports Menu Commands

The following commands are available from the Reports menu:

Generate Report | Displays the Reports Wizard.
Import Custom Report | Displays the Select Reports to Import dialog box.


Tools Menu Commands

The following commands are available from the Tools menu:

FlexChecks | Displays the FlexChecks dialog box.
Edit Known Accounts | Displays the Known Accounts dialog box.
Database Administration | Displays the Database Administration dialog box.
Verify Installation Integrity | Displays an error message if key Internet Scanner files were not installed correctly on your system.
Options | Displays the Options dialog box.
Scan with Database Scanner | (Note: This command is available if Database Scanner is installed on your system.) Displays the Scan with Database Scanner dialog box, which lets you use Database Scanner to scan against database servers (Microsoft SQL Server, Sybase Adaptive Server, Oracle Server) found by Internet Scanner.
Launch Database Scanner | (Note: This command is available if Database Scanner is installed on your system.) Opens Database Scanner on your desktop.


Window Menu Commands

The following commands are available from the Window menu:

Cascade | Displays the List View and the Tree View in Cascade form.
Tile | Displays the List View and the Tree View in Tile form.
Arrange Icons | Resets minimized sessions to defaults.
MRU | Displays a pick list of currently open sessions.


Help Menu Commands

The following commands are available from the Help menu:

Contents and Index | Displays the Contents tab of the available topics in the Internet Scanner help system.
Search | Displays the Search tab of the Internet Scanner help system.
Product Update | Opens a link to ISS for information on the product and for downloading the product.
What’s New | Displays new features in this version of Internet Scanner.
About Internet Scanner | Displays copyright and version information.


Toolbar - No Session Selected

When there is no session selected, the toolbar contains the following selections:

Creates a new session.

Opens a previously saved session.

Enables context-sensitive help.


Toolbar - Session Selected

When a session is selected, the toolbar contains the following selections:

Creates a new session.

Opens a previously saved session.

Saves the current scan session in the directory of your choice.

Adds a host to the current scan session.

Deletes currently selected host or subnet tree.

If checked, displays all hosts in the Tree View.

Starts a scan on the currently selected host.

Starts a scan in a command-line window.

Edits the settings policy for the current session.

Enables context-sensitive help.


Starting Internet Scanner

There are several methods for starting Internet Scanner:

  • From the command line, type Iss_WinNT and press Enter to start the Internet Scanner graphical user interface (GUI).

  • From the command line, type Iss_WinNT, followed by command-line options. Internet Scanner runs from the command line. This choice is useful for very large networks or when you want to forego the added overhead of the user interface.

  • From the Windows NT Start menu, select Programs [image] ISS [image] Internet Scanner 6.0 [image] Internet Scanner 6.0 to start the Internet Scanner graphical user interface (GUI).

  • Use a scheduler to automatically initiate scans or generate reports at a specified date and time.


Startup Window

Displays frequently used choices when you first start Internet Scanner.

  • To prevent this window from displaying at startup, select the Don’t show this dialog again check box.

  • To make this window appear at startup, follow these steps:

    1. Open Registry Editor.

      Warning: Using Registry Editor incorrectly may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

    2. Go to the HKEY_LOCAL_MACHINE\SOFTWARE\ISS\Internet Scanner\6.0\General key.

    3. Double-click the NoStartupDlg value to display the String Editor.

    4. To enable the startup window, type Off and click OK.


Command-Line Scanning Options

Internet Scanner can be run from a command line. This is helpful if you want to schedule scans to occur at specified times or intervals, or if you want to scan a very large network.

To run Internet Scanner from a command line, follow these steps:

  1. Open a command-line prompt.

  2. Go to the Internet Scanner install directory.

  3. At the command prompt, type ISS_WinNT, followed by the appropriate options from the following list, and press Enter.

Note: If you do not enter any arguments, Internet Scanner starts its graphical version, but performs no actions.

The following options may be used to start Internet Scanner from the command line:

Option | Description
-f <host_file> | Scan using the specified host file.
-h, -? | Help. Displays these options in a Help dialog box.
-i | Interactive mode. Displays a dialog box if information is missing or invalid. If you omit this option, Internet Scanner will not provide a warning message that it’s about to terminate the program.
-k <key_file> | Specify key file to use.
-p <policy> | Specify policy to use.
-r <range> | Specify host range to scan.
-s <session_file> | Names the session to load. Specifying a session overrides range, policy, key file, and host file settings.
Note: -f, -r, and –s are mutually exclusive.

Related Topics


Examples of Scanning Options

  • To display Internet Scanner command-line help, type:

    Iss_WinNT -?
    Iss_WinNT –h

  • To scan using a specified key and a user-defined policy, type:

    Iss_WinNT –k iss.key –p “L1 Inventory”

  • To scan specifying two ranges of scan addresses (ranges must be in the key file), type:

    Iss_WinNT –k iss.key –r 98.97.96.02-98.97.96.128,37.37.90.1-37.37.90.200

Notes about using command-line scanning options:

  • Scanning is not possible without a valid key. Evaluation copies of Internet Scanner cannot run from the command line.

  • All switches for scanning options must be in lowercase. All switches for reporting options must be in UPPERCASE.

  • If any of your variables are separated by a space, be sure to use double quotes around the variable. For example, specifying the L1 Inventory policy switch would appear as: –p “L1 Inventory”

  • If you start a scan and generate a report from the same command line, the scan must complete before the report prints. This holds true even when the report is unrelated to the scan.

  • When specifying a .hst (host) file, .key file, or .session file, the file name extension is required.

  • The –f, –r, and –s switches are mutually exclusive.

  • Specifying a session overrides the range, policy, key file, and host file settings.

  • If no key is specified, Internet Scanner prompts you to select a valid key.

  • If no policy or session is specified, Internet Scanner uses the most recently used settings.

  • If no host file or scan range is specified, Internet Scanner scans all hosts specified in the key file.

Related Topics


Command-Line Report Options

The following options may be used to generate or export Internet Scanner reports from the command line.

Option

Description

-R <report_id>

Identifies the report to print. See the Report IDs for available reports.

-J <job_ID>

Identifies the job for which you want to generate a report.

-X[D|W|H][O] <report_id>
[=output_file]

Exports a report to a file. The following values are valid:

D—Export the report in DIF format.

W—Export the report in Word format.

H—Export the report in HTML format (default if omitted).

O—Optional. Overwrite the output file if it exists. If omitted, exporting will not overwrite existing file names.

report_id—Required. Identifies the report to export. See Report IDs for available reports.

Note: When specifying an output file, do not include a space character on either side of the equals (=) sign.

=output_file—Optional. Specifies the file name to use for the report. Internet Scanner appends the appropriate file name extension depending on the format (DIF, DOC, or HTML).

Related Topics


Examples of Report Printing Options

  • To generate the Technician Vulnerability Assessment report sorted by IP Address for the last job, type:

    Iss_WinNT –R techvuln.ip
    Iss_WinNT –R techvuln.ip –J 0

  • To perform a scan and generate a report on that scan, type:

    Iss_WinNT –f hosts.hst –p “L1 Inventory” –R lineport

  • To generate several reports for several job numbers, type:

    Iss_WinNT –R lineos.ip –R techvuln.ip –R lineport -J 392 –J 18 –J 106

  • To generate several reports for the three most recent jobs, type:

    Iss_WinNT –R lineos.ip –R techvuln.ip –R lineport -J 0 –J -1 –J –2

  • To export the Line Management Operating Systems Report Sorted by OS Name in default HTML format for the most recent job (output appears in the ..\scanner6\Exported directory as OsIpDns.html), type:

    Iss_WinNT –X lineos.os

  • To export the Line Management Operating Systems Report Sorted by OS Name in DIF format for several job numbers, and to specify a custom file name (output appears in the ..\scanner6\Exported directory as example-report.DIF), type:

    Iss_WinNT –XD lineos.os=example-report –J 313 –J 222 –J 51

  • To export to a custom file name containing spaces, and overwrite the file name if it already exists (output appears in the ..\scanner6\Exported directory as report with spaces.html), type:

    Iss_WinNT –XO “lineos.os=report with spaces”

Notes about printing reports from the command line:

  • Report switch options must be typed in UPPERCASE. Scanning switch options are in lowercase.

  • All of the reports are available from the command line.

  • If your command line specifies scanning options, then the scanning must complete before Internet Scanner generates the reports. This holds true even when the reports are not related to the scan.

  • For reports that use a variety of sorting methods, verify that you added a dot (.) between the report name and the sort field. For example, to sort the Technician Vulnerability Assessment report by DNS, use: –R techvuln.dns

  • If any of your variables are separated by a space, be sure to use double quotes around the variable. For example, specifying the L1 Inventory policy switch would appear as: –p “L1 Inventory”

  • Reports print to the default printer. Verify that your default printer settings are correct before issuing the commands.

  • By default, the last scan job ID is zero (0), as in –J 0. A negative number may be used as an offset to the last scan job, as in –J –1 for the second to the last scan job. Positive numbers refers to the actual job ID, as in –J 42.

  • Omitting the job number from the command line generates the report for the most recent scan job.

  • On one command line, Internet Scanner generates reports for all specified jobs. It is not possible to exclude reports for specific jobs using one command.

  • You must use a separate switch for each report and job. See the “To generate several reports for several job numbers” example in this topic.

  • When exporting to a custom file name, do not use spaces around the equals (=) sign. If the output file contains a name, enclose the entire report_ID=output_file pair in quotes. See the “To export to a custom file name containing spaces” example in this topic.

Related Topics


Report IDs

The Report IDs correspond to the individual Internet Scanner reports available from the Generate Report command. Use these labels to generate reports from the command line.

Examples:

  • To generate the Executive Trend Analysis report for the most recent job, type:

    Iss_WinNT –R execsumtrend

  • To generate a Technician Operating Systems report sorted by IP Address for the most recent job, type:

    Iss_WinNT –R techos.ip

Note: Do not forget the dot (.) between the report name and the sort option.

Executive Reports

Report IDs | Report
execsumos | Executive Operating System Summary Report
execsumtrend | Executive Trend Analysis Report
execsumvuln | Executive Vulnerability Summary Report

Line Management Reports

Report IDs | Report
linehost.dns | Line Management Host Assessment Report Sorted by DNS
linehost.ip | Line Management Host Assessment Report Sorted by IP Address
linehost.os | Line Management Host Assessment Report Sorted by OS
lineos.dns | Line Management Operating Systems Report Sorted by DNS Name
lineos.ip | Line Management Operating Systems Report Sorted by IP Address
lineos.os | Line Management Operating Systems Report Sorted by OS Name
lineport | Line Management Services Report Sorted by Port Number
linesvc | Line Management Services Report Sorted by Name
lineuser.ip | Line Management Users Report Sorted by IP Name
lineuser.os | Line Management Users Report Sorted by OS Name
lineuser | Line Management Users Report Sorted by User Name
linevuln.dns | Line Management Vulnerability Assessment Report Sorted by DNS Name
linevuln.ip | Line Management Vulnerability Assessment Report Sorted by IP Address
linevuln.sev | Line Management Vulnerability Assessment Report Sorted by Severity

Technician Reports

Report IDs | Report
techhost.dns | Technician Host Assessment Report Sorted by DNS Name
techhost.ip | Technician Host Assessment Report Sorted by IP Address
techhost.os | Technician Host Assessment Report Sorted by OS Name
techos.dns | Technician Operating Systems Report Sorted by DNS Name
techos.ip | Technician Operating Systems Report Sorted by IP Address
techos.os | Technician Operating Systems Report Sorted by OS Name
techsvc.dns | Technician Services Report Sorted by DNS Name
techsvc.ip | Technician Services Report Sorted by IP Address
techsvc.os | Technician Services Report Sorted by OS Name
techvuln.dns | Technician Vulnerability Assessment Report Sorted by DNS
techvuln.ip | Technician Vulnerability Assessment Report Sorted by IP Address
techvuln.os | Technician Vulnerability Assessment Report Sorted by OS Name
techvuln.sev | Technician Vulnerability Assessment Report Sorted by Severity

Related Topics


Scheduling Internet Scanner

To run Internet Scanner at specific times during the day, use the Windows NT at.exe command from the command line, or use the WinAt user interface. WinAt is available from the Windows NT Resource Kit.

Note: The Scheduler service must be active to use at.exe or WinAt. Refer to your Windows documentation for other prerequisites and capabilities of at.exe and WinAt.

For example, using at.exe to run a local copy of Internet Scanner 3 times a day at 6 PM every 5 days, type on one line:

at 18:00 /interactive /every:5,10,15,20,25,30 “C:\Program Files\ISS\Scanner6\Iss_WinNT.exe” -k iss.key

If you are experiencing problems launching the scheduled application, check your Event Viewer’s System Log for messages.

Related Topics


To Create a New Session

Creating a New Session

From the Internet Scanner main window, there are several ways to create a new session:

  • At startup, select Create a New Session.

  • From the File menu, select New Session.

  • Click the New toolbar button.

All these options display the New Session Wizard, which will guide you in setting up the session and create the new session.

Related Topics


New Session Wizard - Key Select

If you have a properly installed key from ISS, that key is displayed in this dialog box. If you purchased more than one key, all keys are displayed in the list. Select the desired key. To begin a scan session with that key, click Next to select a policy for the session. Click Display Key to display the currently loaded key.

Related Topics


Display Key

Displays information about the registration key that enables your ISS software to work. Internet Scanner has built-in protection to ensure that it can only scan the networks it is intended to scan. Internet Scanner searches for keys in the same directory the program executables are installed. The default extension is *.key.

To view the contents of a specific key, double-click its entry in the Browse dialog box. The key information is displayed in the following format:

Key Item | Description
Customer | The name of the customer associated with this key.
Number | Your ISS customer number.
Expire | Expiration date of the key. Internet Scanner no longer conducts scans after this date. (To obtain a new key, contact ISS at sales@iss.net.)
Account | Your ISS account name.
E-mail | Your e-mail address.
Creation Date | The date and the time the key was created.
Maximum Devices | Number of devices the software can be used to scan.
Current Device Count | The number of hosts that have already been scanned using this key.
TCP/IP Address Ranges and Internet Scanner Flags | The scan is restricted to the ranges that are enabled in your key, if any. Internet Scanner flags describe the features that are enabled: I = Internet Scanner H = Host Scanner F = Firewall scanner W = Web Scanner S = System Scanner R = Real Secure

Related Topics


No Valid Key Found

Internet Scanner was unable to find a valid key. If you received a key from ISS, make sure that you saved it in the Scanner6 directory and that the file extension is “.key.”

Related Topics


Installing Your ISS Key

When you receive your key or keys from ISS, you must follow these steps to ensure correct installation.

  1. Select the message text.

  2. From your mail reader file options, select Save As.

  3. Save the message as “iss.key” (or some variation, if you have more than one key) and place it in the main Scanner6 directory. The file name extension must be .key, or the key will not be valid.

Important: Some text editors, such as Notepad, save all files as *.txt files. When saving your key in a Windows text editor, you must put double-quotes around the filename to prevent Notepad from appending a .txt extension to the file. If such an extension is appended, Internet Scanner cannot read the key file.

Related Topics


New Session Wizard - Policy Select

From the Policy Select dialog box, select one policy to use for the scan. A policy consists of a collection of settings that define which checks occur on the target hosts.

Select one or more of these choices:

  • If you do not see the policy you need, click Add Policy to define a new policy. You will return to the New Session Wizard after you finish defining the new policy.

  • Click a custom policy that you have previously created. Click Next after you have chosen a policy.

Related Topics


New Session Wizard - Comment

Add an optional comment used to describe your scan session in the session log. The comment is recorded in the database and used in some of the reports.

Related Topics


New Session Wizard - Specify Hosts

Choose how Internet Scanner determines which machines to scan:

Use Host File: Lists all .hst hosts files. Select a host file from the list, and Internet Scanner reads the host IP addresses and discards any hosts outside of the key’s scan range. See New Session Wizard - Select Host File.

Use Command Line Facility: Enter a range of IP addresses directly. See Enter Hosts.

Ping all valid hosts in your key range: Pings the scan range to find all active hosts. You may also choose to ping a subset of your scan range. Hosts found by pinging can be saved to a hosts file for later use. See File Menu Commands. Important: This option is available only if your key uses IP address restrictions.

Related Topics


New Session Wizard - Select Host File

Select the host’s file you would like to load. A host’s file is required to have the IP address starting in the first column of the file, with one IP address per line. Any lines beginning with either a space or a ‘#’ sign are ignored as a comment. Any hosts that are outside the scan range are also ignored. The number of hosts that may be loaded is limited only by available memory and your scan range.

For example, assuming your key contains these IP addresses, this example.hst host file is set up to scan three devices:

129.0.0.45
#129.0.0.46 (do not scan)
129.0.2.102
129.0.2.103

Related Topics


Working with Host Files

Working with an exported host file can be more convenient than using the New Session Wizard every time you want to scan some of the hosts in your key’s range. You can use a host file if you want to scan a specific subset of hosts without typing them all in via the command-line option. If you want to be able to scan the same subset of hosts repeatedly, saving those hosts in a host file makes the process more convenient. You can begin by pinging the range of hosts in your key, saving the results and editing the file in a text editor. Note: The Internet Scanner Resource Kit contains the genhosts utility, which creates a set of host files from information stored in Internet Scanner’s database.

  • To export a host file.

Once you have exported a host file, it can be edited. This allows you to use Internet Scanner’s command-line option to quickly access the specific list of hosts you want to scan.

  • To edit a host file.

Once a host file has been edited and saved, it can be invoked from a command line or accessed from the New Session Wizard’s Select Host page.

Related Topics


New Session Wizard - Command Line

The Command Line dialog box lets you use Internet Scanner’s user interface to enter host options in the same syntax used by the command-line version of Internet Scanner. This option is helpful if you need to scan hosts that cannot return pings (such as hosts that reside behind a firewall). Using this option ensures that such hosts are scanned if the “Select Scan if Ping Fails” option is selected.

This option is also useful if you plan to routinely scan small subsets of your network. You can specify particular subsets of hosts no matter where they reside in your domain.

Enter the hosts you want to scan or select from the list. Any host files (*.hst) found in the Scanner directory are displayed in the list. Host lists must be entered in a special format.

Load Values From Key: Loads the allowed scanning range into the edit control from the selected key. If a key contains several ranges, it may be easier to edit the ranges than to type them in manually.

Related Topics


New Session Wizard - Ping Range

Select Finish to locate all of the hosts within the range of the selected key. If you want to use range or subset of specific IP addresses on your network, click the Edit Range button. See Edit Address Range.

Related Topics


Edit Address Range

You may limit the network range that Internet Scanner will ping to a subset of the range enabled by your key. Host lists can be entered in the following combinations, where “IP” represents a dotted IP address:

IP,IP: two separate hosts

IP-IP: a range of hosts

IP-IP,IP: a range and a single host

IP-IP,IP-IP: two ranges

Any number of ranges and individual hosts may be combined. No spaces are permitted.

Related Topics


Scanner Settings

The Scanner tab configures Internet Scanner for logging and reporting options.

General

Grab Critical Files: Enables Internet Scanner to copy critical files. These files are placed in the “pwd” directory located under the installation directory. This directory should be secured on installation, and Internet Scanner warns the user if it is insecure at the beginning of a scan. The vulnerabilities that can permit the password file to be obtained are:

  • Sendmail Remote Execution

  • TFTP (Trivial File Transfer Protocol) Running

  • Domain Names and NIS Servers

  • Rsh Vulnerable in hosts .equiv

  • Rlogin -froot Vulnerability

  • Anonymous FTP

  • FTP Default Account Accessible

Generate Session Log Files: Allows Internet Scanner information to be added to log files. This information is used for debugging purposes only and can substantially inflate the size of the log.

Verbose Output: Enables additional output to the log files.

Diagnostic Output: Generates information in the session log files used in monitoring the Telnet Brute Force behavior. Caution: Enabling this option can increase the size of the log files.

Ping Timeout (ms): Sets maximum timeout value for a ping, in milliseconds. This value may be decreased on fast networks to allow more rapid network enumeration, or increased on slower networks if not all hosts are found.

Scan if ping fails: Perform a scan even if the host is not able to return ping requests. This is frequently the case when a firewall is between the host and Internet Scanner. Warning: Enabling this option significantly increases scan times.

Always Run Exploits: Runs exploits even if the Scan if ping fails option detects no services after running the service scan, the port scan, and the half scan. (This option is enabled only when Scan if ping fails is enabled.) Warning: Enabling this option significantly increases scan times.

Threads

Maximum Parallel Scan Threads: Lets you select how many parallel scans can occur at one time. Parallel scanning decreases the total time it takes to scan, but increases the processor load and slows other processes on the machine running the scan. The maximum number of parallel scans is 128 in the Windows NT version. On slower CPUs (166 MHz or slower), ISS recommends setting the maximum number of parallel scans to 64 in the Windows NT version.

Number of Parallel Service Scans: Internet Scanner uses dedicated threads for TCP service scanning. The load on your network is directly proportional to the number of service scan threads, and should be left at four threads for a 10-megabit Ethernet network. Non-paged pool system RAM also rises with an increase in service scan threads. If additional performance is required, carefully monitor system memory usage and network capacity utilization. The maximum value is 16 threads.

Important: This parameter controls how much network traffic is generated during a scan. If you are scanning across slow or WAN links, ISS recommends setting this value to 2, or even 1.

Connections

Maximum Connections (Default Checks): The maximum number of connections Internet Scanner will make to the host during Brute Force checks. The default value is 32 connections, with a maximum value of 50 connections.

Delay: The amount of time in milliseconds that Internet Scanner waits between connections made to the host during Brute Force checks. The default is 100 milliseconds.

Maximum Connections (Port Scan): Specifies the maximum number of ports that a thread can open simultaneously. The default is four ports, with a maximum value of 1024 ports. Important: When scanning a small number of hosts, increase this value accordingly to expedite the scan.

Timeout (ms): Maximum timeout value for a port scan, in milliseconds. The default is 9000 milliseconds.


File Locations

Field Name | Description
Log Directory | The directory where the scan logs are kept. This directory should be secure.
Dictionary File | A file containing the words used in trivial password guessing.
X Bitmap File | The bitmap used in the X Windows Check (Xsetroot on Vulnerable Workstation vulnerability).
Temp Directory | The directory where logs are stored during a scan. This directory should be secure.
Pwd Directory | The directory used to store any sensitive files (/etc/passwd, .pwl files) that Internet Scanner acquired during a scan. This directory should be secure.
Known Accounts | A .bin file containing the Windows NT accounts that SmartScan has cracked or will attempt to crack during a scan session. The default is knownaccounts.bin.

Important: ISS recommends placing Internet Scanner on an NTFS file system. During installation, Internet Scanner sets the appropriate directory permissions.


What is SmartScan?

SmartScan analyzes vulnerabilities detected in previous scans, and builds on these vulnerabilities to discover additional vulnerabilities and security weaknesses on your network.

Internet Scanner defaults to SmartScan—no configuration is required to enable this capability. However, if you want to enable or disable the SmartScan feature, or enable the SmartScan feature in a default policy or custom policy, use one of the following methods:

  • Enabling SmartScan

  • Disabling SmartScan

  • Using SmartScan with information gathered in the current session


Edit Known Accounts

The Edit Known Accounts feature lets you create, edit, or delete Windows NT account-password pairs that SmartScan has cracked or will attempt to crack during a scan session.

The Known Accounts file, described in Tools [image] Options [image] File Locations, contains a list of the account-password pairs used by SmartScan during a scan over your network.

The account-password pair includes:

  • an account—a combination of a user and the user’s domain, and

  • a password—known to be correct for the account (verified) or not known to be correct for the account (unverified).

Dialog Box Elements

Element | Description
User | The user name of the Windows NT account.
Domain | The user’s domain.
Password | The user’s password.
Verified | The status of the user’s password. indicates a password is verified and [image] indicates a password is unverified.
Add | Add new account-password pairs to check for during a scan.
Edit | Lets you modify an account in the Known Accounts file.
Delete | Lets you remove an account from the Known Accounts file.
Related Topics


Cautions and Considerations

Many tests used by Internet Scanner push the limits of the system’s operation, looking for vulnerabilities. While you are planning or implementing a test plan, consider these issues:

  • Notify individuals of scanned devices in advance of a scan. This way, system owners know which scans are authorized, and can take action and make improvements based on the scan results.

  • Scans should be run at various times of the day and the week to improve the chances of accessing systems that may be unavailable at certain times.

  • Use occasional unscheduled scans to maintain the secure state of the network. Only run unscheduled scans against systems that have passed a scheduled scan.

  • Scan new systems as soon as possible after adding them to a secure network. Perform the scan in cooperation with whomever is responsible for the system and network connectivity.

  • Allow systems to opt out of scans if special needs, circumstances, or justifications (such as pending upgrades) are in effect.

  • Schedule Denial of Service tests, which can cause system interruptions in vulnerable systems, after you have notified the system owner.

  • If Internet Scanner uncovers an unknown vulnerability, contact your vendors or security agencies to obtain corrective actions and advisories. Updates to Internet Scanner may also be available at the ISS Web site at http://www.iss.net.


Creating a FlexCheck

To create a FlexCheck:

  1. From the Internet Scanner main window, select Tools [image] FlexChecks to display the FlexChecks dialog box.

  2. Click Add to open the Add FlexCheck dialog box.

  3. In the Check Name box, type a name for the FlexCheck you want to create. When the vulnerability for the FlexCheck is found, Internet Scanner displays the check name in the Additional Information section of a generated report.

  4. In the Executable box, type the directory path or click Browse to locate the FlexCheck’s executable file in your local directory. The executable file for the FlexChecks must have an .exe file name extension.

  5. In the Arguments box, type command-line arguments to be passed to the executable during the scan. Before launching the executable for the host, Internet Scanner appends the IP address for each scanned host to the argument.

  6. In the Timeout (secs) box, specify the number of seconds that each instance of the executable for your FlexCheck will run. If the executable times out, Internet Scanner stops the executable from running, logs the timeout information, and notifies you that the executable has timed out. The default range is 120 seconds, with an allowed range from 10 to 300 seconds.

  7. In the Info box, type details about your FlexCheck, including a description of the vulnerability and its fix information. When the vulnerability for the FlexCheck is found, Internet Scanner displays the vulnerability information from this field in the More Information section of a generated report.

  8. Click OK to apply the information to the FlexCheck, and exit the Add FlexCheck dialog box.

  9. Click Exit to exit the FlexChecks dialog box, and return to the Internet Scanner main window.


Backdoors

The Backdoor exploits look for attacker-placed backdoors on systems.


Browser

The Browser exploits look for vulnerabilities in Internet Explorer and Netscape Navigator, and test URL security levels depending on how you classify a host or Web site.


Brute Force

The Brute Force exploits test for weak accounts, passwords, and services with permutations of frequently used terms.


CGI-Bin

The CGI-Bin exploits test for weaknesses in CGI files and programs that use the Web.


Daemons

The Daemon exploits examine Unix processes (and equivalent Windows services) for vulnerable versions or weak security.


DNS

The DNS exploits test Distributed Naming Service implementations for vulnerabilities.


E-mail

The E-mail exploits test for vulnerabilities related to the Simple Mail Transport Protocol (SMTP).


Firewalls

The Firewall exploits test firewalls for default user security weaknesses.


FTP

The FTP exploits test weaknesses in the File Transfer Protocol and its implementations.


LDAP

The LDAP exploits test Lightweight Directory Access Protocol (LDAP) servers.


NIS

The NIS exploits test Network Information System implementations for vulnerabilities.


NT Critical Issues

The NT Critical Issues exploits contain security tests that strengthen and monitor security-related activities on a Windows NT computer.


NT Password

The NT Password exploits test Windows NT accounts, including User, Password, and Lockout checks.


NT Registry

The NT Registry exploits test the security of a host’s registry, including keys that protect the Simple Network Management Protocol (SNMP).


NT Services

The NT Service exploits detect running Windows NT services and security weaknesses associated with services.


NT Users

The NT User exploits include tests that determine if additional user-level security has been implemented on the computers you scan.


Router/Switch

The Router/Switch exploits test packet routers and networking hardware for vulnerabilities.


RPC

The RPC exploits test Remote Procedure Call (RPC) services and vulnerabilities.


SNMP

The SNMP exploits test Simple Network Management Protocol implementations for vulnerabilities.


Web Scan

The Web Scan exploits test for weaknesses in files and programs that use the Web, such as IIS and HTTP.


Building Views

The Policy Editor folder tree can be displayed in four different views. The Views are explained in detail in the following topics:

  • Built-Ins/Plug-Ins View

  • Category View

  • Risk View

  • Standard View

When you first open the Policy Editor, Internet Scanner defaults to the Standard View. If you close the Policy Editor, and then re-open the Policy Editor, Internet Scanner uses the view that you were in when you last closed the window.


Built-Ins/Plug-Ins View

The Built-Ins/Plug-Ins View displays the vulnerability categories as either built in to Internet Scanner (Built-In Exploits) or installed as an X-Press Update (Plug-In Exploits). Use this view to find checks that you have added using the X-Press Updates install program.


Category View

The Category View displays the vulnerability categories in alphabetical order.


Risk View

The Risk View displays the vulnerability categories according to risk level (high, medium, or low).

Risk View Levels

Risk Level | Icon | Description
High |  | Any vulnerability that allows an attacker to gain immediate access into a machine, to gain superuser access, or to bypass a firewall. Example: A vulnerable Sendmail 8.6.5 version that allows an intruder to execute commands on mail server.
Denial of Service-High |
Medium |  | Any vulnerability that provides information, degrades performance, or has a high potential of giving system access to an intruder. Examples: The Data Flood denial of service exploit, or a misconfigured TFTP or vulnerable NIS server that allows an intruder to get the password file that could contain an account with a guessable password.
Denial of Service-Medium |
Low |  | Any vulnerability that provides information that could potentially lead to a compromise. Example: A finger that allows an intruder to find out who is online and potential accounts to attempt to crack passwords via brute force methods.
Denial of Service-Low |


Policy Menu Commands

The following commands are available from the Policy menu:

Save | Saves the current policy.
Save As | Saves the current policy under a new policy name.
Print | Prints the policy summary for a scanned host, sorted by exploit name, exploit class (category), or exploit risk level.
Close | Closes the Policy Editor.


View Menu Commands

The following commands are available from the View menu:

Help at Top | If checked, places the embedded vulnerability help information at the top of the Policy Editor window.
Refresh | Updates the current view in the Policy Editor.


Help Menu Commands

The following commands are available from the Help menu:

Contents and Index | Displays the Policy Editor topic in the Contents tab of the Internet Scanner help system.
Search | Displays the Search tab of the Internet Scanner help system.
About | Provides a list of Internet Explorer and HTML Help-related DLLs and their version information.


Toolbar

The Policy Editor toolbar contains the following selections:

Toolbar Icon | Description
 | Saves the current policy in the Policy Editor.
 | Goes to a previous page or vulnerability description in the browser-enabled Vulnerability Information window.
 | Goes to the next page or vulnerability description in the browser-enabled Vulnerability Information window.
 | Displays the Configure Search dialog box used to set up the Policy Editor’s keyword search.
 | Lists the current view in the folder tree of the Policy Editor. The Policy Editor can display the Built-Ins/Plug-Ins View, the Category View, the Risk View, or the Standard View.


Tips for Creating Custom Policies

To create a custom policy, you can turn various checks performed by Internet Scanner on or off, and save the configuration as a new policy. You can create a custom policy in the following ways:

  • Base a Policy on an existing Policy: Saving each new policy you create gives you a wide range of choices and facilitates a “stepped approach” to checking for network vulnerabilities.

  • Create a new Policy: Enable only the checks for the vulnerabilities you want Internet Scanner to check. This lets you scan your network for one or more known or suspected vulnerabilities.

Here are some suggestions for using policies to better understand your network:

  • Create a “Baseline” policy with all checks turned off: This policy provides you with a foundation from which to create finely-tuned policies. You can target one specific check, or a specific group of vulnerabilities to be scanned, and save time by eliminating unnecessary checks.

  • Create a “Reference” policy: Turn on all checks, except those known to crash the host or cause other network problems (see Denial of Service policy settings in the Policy Editor’s Standard View). This policy provides a useful record of all vulnerabilities found on an initial scan of your network. Saving a reference scan lets you comprehensively document the state of your network, and can be repeated if major network changes occur.

  • Create a “Denial of Service” policy: Check only the vulnerabilities that are known to disrupt a machine or network. Since running a Denial of Service scan can result in serious loss of productivity if vulnerabilities are detected, such scans should only be run when necessary and at carefully scheduled times. Instead of temporarily adding a Denial of Service check to an existing policy, you can run your custom policy. This prevents accidents, such as forgetting to disable the check before your next routine scan. You can permanently turn off all Denial of Service checks in all your other policies, thereby preventing accidental crashes and loss of productivity or revenue. Note: Before running a Denial of Service Scan, we recommend notifying all users and the Administrators. This advance warning lets them make preparations, such as saving their work before risking the possibility that their machine will crash.

Related Topics


Executive Reports

The reports generated under the Executive Reports option provide summary information for rapid assessment of top-level security issues. The following reports can be generated in English, German, Spanish, French, Italian, Portuguese, or Brazilian Portuguese:

  • Operating System Summary: Provides an overview of operating systems discovered during an automated network scan, by percentage and number of hosts per operating system.

  • Trend Analysis: Depicts network vulnerability trends over a stated period of time, providing a detailed, side-by-side analysis of vulnerabilities by category (low risk, medium risk, and high risk).

  • Vulnerability Summary: Summarizes the organization’s susceptibility to attack in relation to policy and vulnerability conditions.

Related Topics


Line Management Reports

Reports generated under the Line Management reports option can be used for resource planning. They show details of network scans, sorted by a variety of criteria.

  • Accounts: The Accounts reports provides a detailed description of all user accounts detected on the scanned hosts, sorted by IP Address, OS Name, or User Name.

  • Host Assessment: The Host Assessment reports identify all services, vulnerabilities, and corrective actions, sorted by DNS Name, IP Address, or OS Name.

  • Operating Systems: The Operating Systems reports identify all services, vulnerabilities, and corrective actions, sorted by DNS Name, IP Address, or OS Name. This data may not include all networked devices or correctly identify their associated operating systems.

  • Services: The Services reports identify services detected by an automated network scan, sorted by port number or name.

  • Vulnerability Assessment: The Vulnerability Assessment reports provide a description of all vulnerabilities detected on the scanned hosts, sorted by DNS Name, IP Address, or Severity.

Related Topics


Technician Reports

The reports generated under the Technician option provide the most detailed information on your network’s status, including instructions for how to fix or patch the vulnerabilities detected by Internet Scanner. The following reports can be generated:

  • Host Assessment: The Host Assessment reports identify all services, vulnerabilities, and corrective actions, sorted by DNS Name, IP Address, or OS Name.

  • Operating Systems: The Operating Systems reports identify all services, vulnerabilities, and corrective actions, sorted by DNS Name, IP Address, or OS Name. This data may not include all networked devices or correctly identify their associated operating systems.

  • Services: The Services reports identify services detected by an automated network scan, sorted by DNS Name, IP Address, or OS Name.

  • Vulnerabilities: The Vulnerabilities reports displays your organization’s susceptibility to attack in relation to its policy and vulnerability conditions, sorted by the report you select (by DNS Name, IP Address, Operating System Name, or Severity).

Related Topics


Generate Reports

To finish generating your report, click Close or choose from the following options:

Preview the Report: Displays a preview of your report as it will look when printed, including detailed information on the content of the report.

Export the Report: Displays the Export dialog box used to select the format and destination of the report.

Print the Report: Displays the Windows Print dialog box used to select print options or send the report to a printer or file.


User Imported Reports

You can create reports to your own specifications, if desired. Initially empty, this folder is provided for your custom reports.

Related Topics


Export Report

You can export Internet Scanner reports in a variety of formats, such as Data Interchange Format, HTML, and Microsoft Word. Select the desired format and click OK, then browse to the appropriate directory if it is other than the default.

You can also export a report from the command line.

Note: When exporting Vulnerability reports, be aware that the fix and patch information is not translated as live links. The browser-enabled Vulnerability Description window on the Policy Editor contains detailed fix information, including live links to patch and information sites.

Related Topics


Generate Reports - Select Report

Lists the types of reports that can be generated by Internet Scanner’s database. The reports are grouped into four categories:

  • Executive,

  • Line Management,

  • Technician, and

  • User Imported.

To see the types of reports available in each category, click the plus sign ( [image]) to the left of each category. For more information about a specific report, select the report name in the list. A brief description of the report is displayed on the right-hand side of the dialog box.

To generate a report, select the desired report and click Next. The Report Wizard progresses to the Report Criteria page.

Related Topics


Generate Reports - Report Criteria

Customize selection criteria for the chosen report. The following options are available:

Jobs (Scan Sessions): Lists saved jobs, displayed by Policy, Job ID, Date, and Session. To select a session, click the job’s policy name in the first column. To select multiple sessions, hold the Shift key or the Control (Ctrl) key while making your selections.

Vulnerabilities: All vulnerability risk levels are selected by default. Displays session information sorted by vulnerability. Check High, Medium, or Low to see vulnerabilities listed in those categories.

Hosts: All hosts are selected by default. If you want to include only specified hosts in the report, click Hosts to choose the Hosts to be reported for the selected job.

Services: All services are selected by default. If you want to include only specified services in the report, click Services to choose the services to be reported for the selected job.

Related Topics


Generate Reports - Finish

Displays the reporting options you selected on the previous pages of the Generate Reports Wizard. Click Back to return to previous pages and change your selections.

Print Report: Displays the Print dialog box to set your printer options. Then send a printed version of the full report to the printer settings.

Export Report: Copy the contents of the report to a file for use with another application.

Preview Report: Displays a screen version of your report as it will look when printed, including detailed information on the report’s content.

Finish: Closes the Generate Reports Wizard.

Related Topics


Database Administration

Configures basic Database Administration. The following options are available:

Current Data Source

Data Source: Displays the current DSN (Data Source Name).

ODBC Driver: Displays the ODBC driver currently in use. Note: ODBC is configured from the ODBC control panel.

User Name: If you have set up your database to require a User Name-Password combination, type the User Name here.

Password: If you have set up your database to require a User Name-Password combination, type the Password here.

New DSN: Launch the Database Wizard to create a new data source, or to change the data source that Internet Scanner uses (helpful when you are maintaining multiple databases). Warning: When you initialize this option, all information in the database, including vulnerability information and service information is cleared and will need to be reloaded. Use this option at your own risk.

Maintain: Opens the Maintain Database dialog box used to change settings in existing data sources. This operation can only be performed when no sessions are open.

View Tables: Click this button to open the View Tables dialog box. For more information, see View Tables.


Database Schema

Using Microsoft Access, you can create custom reports or merge Internet Scanner database information with other database files. These tables provide a brief description of Internet Scanner’s database schema:

  • Banners Table

  • FilesInstalled Table

  • Hosts Table

  • HostsFound Table

  • Jobs Table

  • SchemaVer Table

  • Services Table

  • ServicesFound Table

  • Users Table

  • UsersFound Table

  • VersionHistory Table

  • Vulns Table

  • VulnsFound Table


Maintain Database

Displays the currently selected data source and lets you select from the following actions:

  • Initialize the selected data source and load tables (Caution: This action results in the permanent loss of data in the selected data source).

  • Upgrade the selected data source (Not implemented in this version).

  • Archive the selected data source (Not implemented in this version).

  • Restore a previously archived data source (Not implemented in this version).


Database Wizard

The Database Wizard lets you select or create data sources that are used to generate Internet Scanner’s reporting output. The Database Wizard guides you through compiling, configuring, and naming data sources.

Step 1 of the Database Wizard requires you to create a new data source or select one from a list of existing (saved) data sources. Choose an option and click Next.

Related Topics


Selecting an Existing Data Source

Select from the list of available (previously saved) data sources and click Next.

Configure: Click this button to configure ODBC setup for the selected data source.

Note: Before data sources can be properly integrated with Internet Scanner’s database functions, the ODBC driver for the desired data source must be installed through the ODBC control panel.


Creating a New Data Source

Select the type of data source that you want to create and click Next.

Note: In the current version of Internet Scanner, Microsoft Access 97 is the only fully supported data source.


Naming the Data Source

Type a name for your new data source. You can also assign a User Name and Password.

Note: If you configured your database software to require a User Name and Password, you must type that information here.


Create Multiple Data Sources

Internet Scanner lets you create multiple data sources, if you are using the same machine to scan several locations and would like to retain a separate data depository for each location.

  • Create multiple data sources

  • Run a scan using a new data source


Database Wizard - Summary

The final step of the Database Wizard lets you review the data source you selected or created, and to initialize your data source if desired. Click Back to change your selections on the previous pages, or Finish to save your selections.

Initializing Your Data

You have the option of initializing the selected data source in this step. Warning: The default option is to initialize the data source. If you accept, all data in the selected data source will be destroyed. If you want to preserve the data in the selected data source, you must select No before selecting Finish.


Banners Table

Name | Type | Comment
jobID | Number (Long) | Job ID for specific scan session
hostID | Number (Long) | Host ID for specific scan session
banner Type | Text | Type of banner (SMTP, FTP, Telnet, etc.)
banner Text | Memo | Banner text


Hosts Table

Name | Type | Comment
HostID | Number (Long) | Host ID
ipAddress | Number (Double) | IP address (Numeric)
firstJobID | Number (Long) | First job ID for this host
lastJobID | Number (Long) | Last job ID for this host
ipAddressStr | Text | IP address as a dotted string
DNSName | Text | DNS name (www.iss.net, for example)
NBName | Text | NetBIOS name
osName | Text | Operating system
NBDomain | Text | NetBIOS domain


HostsFound Table

Name | Type | Comment
hostID | Number (Long) | Host ID
jobID | Number (Long) | Job ID
pingtime | Number (Long) | Ping response time in milliseconds


Jobs Table

Name | Type | Comment
jobID | Number (Long) | Job ID
startTime | Date/Time | Start time
stopTime | Date/Time | Finish time
scanHost | Number (Long) | Scanning host
numHostScanned | Number (Long) | Number of hosts scanned
numHostActive | Number (Long) | Number of active hosts
numHostInactive | Number (Long) | Number of inactive hosts
elapsedTime | Text | Elapsed time of scan session
jobDesc | Text | Job description
jobComment | Text | Job comment
templateName | Text | Policy used for scan session
logfileName | Text | Log file used for session
termStatus | Text | Scan session termination status
upLoaded | Yes/No | Used by SAFESuite® Decisions to determine if the job has been uploaded to the database
keyName | Text | Displays the key file used for the scan session


Services Table

Name | Type | Comment
serviceID | Number (Long) | Service ID
serviceName | Text | Service name
shortdesc | Text | Description
ports | Number (Long) | Port (if any)
assocVuln | Number (Long) | Associated vulnerability
serviceType | Text | Service type (NT, RPC, TCP, UDP)
userNotes | Text | For use by customer


ServicesFound Table

Name | Type | Comment
serviceID | Number (Long) | Service ID
jobID | Number (Long) | Job ID
hostID | Number (Long) | Host ID


Users Table

Name | Type | Comment
userID | Number (Long) | User ID
hostID | Number (Long) | Host ID
userName | Text | User login name
fullName | Text | User’s full name
comment | Text | For use by customer
userPassword | Text | Users’ passwords
imageIndex | Number (Long) | Icons representing a user, a machine, or a group


UsersFound Table

Name | Type | Comment
jobID | Number (Long) | Job ID
hostID | Number (Long) | Host ID
userID | Number (Long) | User ID


Vulns Table

Name | Type | Comment
vulnID | Number (Long) | Vulnerability ID
severity | Number (Integer) | Severity (for future use)
riskLevel | Number (Integer) | Risk level
vulnName | Text | Vulnerability name
shortdesc | Text | Vulnerability title
osAffected | Text | Operating system affected
fullDesc | Memo | Detailed description of vulnerability
fix | Memo | Detailed fix information
usrSeverity | Number (Integer) | For use by customer
usrRiskLevel | Number (Integer) | For use by customer
usrVulnName | Text | For use by customer
usrDesc | Memo | For use by customer
usrFix | Memo | For use by customer
vulnTag | Text | X-Force Database tag name
Caution: In the Name field, do not edit entries missing a usr prefix—these fields may be overwritten in future releases of Internet Scanner. An entry with a usr prefix can be safely edited.


VulnsFound Table

Name | Type | Comment
vulnID | Number (Long) | Vulnerability ID
jobID | Number (Long) | Job ID
hostID | Number (Long) | Host ID
assocInfo | Text | Associated information (such as share name)
moreInfo | Memo | Extended information (such as finger dump)


Database Connection Failed

The database connection may have failed due to one of the following conditions:

Condition | Remedy
The data source does not exist, or the database you associated with Internet Scanner does not exist. | Create a new data source.
Your database login permissions are not correct. | Contact your database administrator to modify your login permissions.
You are not using the latest OBDC drivers available for the database that is being used with Internet Scanner. | Contact your vendor for the latest ODBC drivers.


Internet Scanner Footprints

Footprints

The following footprints are generated by Internet Scanner during a scan:

Footprint Location

Description

Internet Scanner main window [image] New Session Wizard - Specify Hosts dialog box

If you select Ping all valid hosts in your key range when you are configuring a scan, Internet Scanner generates a footprint with the string ISSPNGRQ followed by the program requests. This footprint also occurs immediately before scanning the host. RealSecure can pick up this footprint and use the information in the footprint to identify the scanning host, the version of Internet Scanner you are running, and the key number you are using.

Policy Editor [image] Common Settings [image] NT Logon Sessions

The popup message sent by Internet Scanner contains the IP address of the scanning host, the login name of the user running the scan, and the license number for Internet Scanner. You can disable this message by clearing the check box in the Policy Editor.

To disable the popup message, follow these steps:

  1. From the Internet Scanner main window, select Policy [image] Edit to select the policy that you want to edit.

  2. Double-click the policy icon and click OK to display the Policy Editor.

  3. In the Policy Editor, go to the folder tree and select Common Settings [image] NT Logon Sessions.

  4. Clear the Send Message check box.

  5. Go to Policy [image] Save to save the policy’s settings.

Policy Editor [image] Vulnerabilities [image] E-mail

The SMTP exploits will attempt to send a VRFY command identifying the operative license number, using VRFY X@ISS, where X replaces the license number. You may be able to disable this footprint by disabling the SMTP exploits. Also, if the scanned host is not running an SMTP server, a connection to the port will not be established and the footprint will not be sent.

Policy Editor [image] Vulnerabilities [image] Web Scan

The Web Scan exploits will leave a characteristic footprint by asking for the file Internet_Security_Scanner-Scanned_from_key_X, where X is the license key number. This footprint occurs if you have enabled the Web Scan exploits and the remote host is running the Web server.


Packet storms

Packet Storms on Networks Containing Network Attached Lexmark Printers

Problem Description: The printers incorrectly use the destination IP address of broadcast request packets as the source address in their reply. This can confuse other network devices, causing subsequent packets to be sent to the broadcast address. This particularly manifests itself on subnets using variable length subnet masks.

Problem Resolution: Upgrade to Internet Scanner 6.0.


pcnfsd

pcnfsd (prior to version x.y)

Problem Description: The pcnfsd check can hang the daemon.

Problem Resolution: Upgrade or replace the daemon (recommended) or disable the check.


Pyramid

Problem Description: The NFS mknod check attempts to create a new device in the /dev directory. The kernel incorrectly creates an illegal device in this directory. When the system attempts to access the device, the kernel panics.

Problem Resolution: Go to the Policy Editor [image] Vulnerabilities [image] Built-In Exploits [image] NFS [image] nfsmknod. Make sure that the nfsmknod exploit is not enabled for your policy.


VAX/VMS

VAX/VMS Running UCX 4.2 TCP/IP

Problem Description: System crashes when scanned.

Problem Resolution: Do not scan—even a ping can crash the system. Note: This event can be caused by any scanning application, including SATAN.


Xylan switches

Xylan Switches; Bay, Nortel Passport, Cisco AGS+ (IOS 9.x) Routers

Problem Description: Resource exhaustion on the device causes a disruption of service. Xylan switches may manifest this disruption by dropping the port receiving the packets from Internet Scanner.

Problem Resolution: These devices do not quickly process packets addressed to the router or switch. Remove these devices from the normal network scan, and scan them separately with a light scan of only router or switch checks (do not port scan). Note: These devices allow scanning of systems behind them (you can successfully scan through the device).


Failure to Create Null Session

Explanation: Installing Microsoft’s LAN Manager Security fix (lm-fix) after saving sessions in Internet Scanner causes changes in the Registry. These changes make it impossible to open a null session from a saved session.

Remedy: Run any sessions that were saved prior to installing the LAN Manager fix and re-save them in order to open a null session. Also, make sure that the messenger service is active on the scanning host, or NetBIOS name tables will not be available.


Failure to ID Operating System

Explanation: Internet Scanner identifies operating systems based on the following criteria:

Function Calls

Internet Scanner may gather information from certain NetBIOS function calls. Responses to these function calls allow Internet Scanner to precisely ID an operating system. For example, certain function calls specifically identify an NT host.

Banner Information

When Internet Scanner relies on Banner information, the operating system is identified on the basis of certain strings that are returned from the Banners (such as Telnet, HTTPD, FTP, SMTP, and SNMP). The information contained in these strings is less deterministic than the information gathered from function calls, so the OS identification is somewhat arbitrary.

Other Criteria

Further criteria used to determine operating systems can include information from various Internet Scanner checks, so the reliability of an operating system ID can vary depending on what checks you have enabled in your Scan Policies.


ICMP-based False Alarms

Explanation: The Data Flood, System Log Flood, and Rwhod-based exploits explicitly rely on the Internet Control Message Protocol (ICMP) for positive identification.

The ICMP protocol is a messaging protocol designed to exchange information between hosts, gateways, and networks connected by Internet Protocol (IP). ICMP messages are sent in several situations: when a datagram cannot reach its destination, or when a gateway can direct a host to send network traffic via a shorter route, etc.

ICMP relies on the basic services offered by IP to send and deliver messages, but it is not considered an independent higher level protocol. Instead, ICMP is considered an integral part of IP and must be included with every IP implementation. The problem is that ICMP is not a reliable protocol. For instance, if a message is not delivered correctly to a particular host, ICMP will not resend it.

Internet Scanner uses the ICMP protocol to detect whether selected User Datagram Protocol (UDP)-based services or daemons are available for selected target hosts. This is achieved by sending a series of UDP packets to the selected port that the service or daemon is bound to, and then listening for a response. If the target host responds with an ICMP port unreachable message, then it can be assumed that the service or daemon is unavailable.

If no ICMP port unreachable messages are received, then assume that either a service or daemon is bound to the selected port, or the ICMP packet was lost during transmission. This is possible, for example, when intermittent network problems occur, when scanning through certain firewalls that block the transmission of specific ICMP messages, etc. Since it is impossible to reliably differentiate between these two conditions, Internet Scanner can incorrectly assume that a particular service or daemon is available, which under certain conditions can lead to a false positive.

In an effort to reduce false alarms, Internet Scanner incorporates the following checks:

  1. Before probing a particular port, Internet Scanner first probes a series of low, mid, and high port ranges to determine whether a target host issues ICMP port unreachable messages. If no such messages are received or issued, then Internet Scanner assumes that the target host does not issue these messages under any conditions. In such cases, Internet Scanner disables any exploit checks that directly rely on receiving these messages.

  2. When probing a particular port, Internet Scanner sends multiple UDP packets over a selected time period. This increases the chances of receiving an ICMP port unreachable message that may be lost due to intermittent network problems.

Remedy: Increase the number of UDP packets sent to the selected port per probe. This can be done by adjusting the values in Common Settings [image] UDP Port Scanner.


More Than One Network Card

Explanation: When scanning an NT box with more than one network card, different results can be obtained from each card depending on which card is scanned first.

Remedy: If there are different networking configurations on each interface, scan them separately. Consider the report with the most vulnerabilities to be the authoritative one.


Server Operator Permissions

Explanation: Under a default installation of Windows NT, Server Operators appears in the Security access list of groups with ‘special’ permissions that include write access. On a workstation, Server Operators appears as ‘account unknown’ due to a bug in the Security Permissions dialogs.

Remedy: Make sure that you are logged in at a server rather than at a workstation before attempting to correct this vulnerability.


User Password Checks Disabled

Explanation: Internet Scanner disables specific checks during a scan if the current user does not have Administrator rights on the scanned host, or if the account’s lockout duration is set to forever. The following checks are affected:

  • Brute force options under the Common Settings folder

  • Some of the Users checks in the NT Users vulnerability category

Disabling these checks prevents Internet Scanner from locking out the users on the host.

Remedy: Obtain Administrator access on the target host.


Checking Status Messages in Log Files

Explanation: A log file, generated during a scan, contains status messages of the checks run for each scanned host.

Remedy:

  • To retrieve all the timestamp/status messages from the log file, at a command line, type: findstr /R/C:” #Time Stamp” LOGFILENAME.LOG (LOGFILENAME.LOG is the actual name of the log file.)

  • To find all the timestamp/status messages for a particular host, at a command line, type: indstr /R/C:” #Time Stamp” LOGFILENAME.LOG \findstr /R/C:”xxx.xxx.xxx.xxx”

  • (LOGFILENAME.LOG is the actual name of the log file, and xxx.xxx.xxx.xxx is the IP address of the host.)

Note: When typing these commands, always use terminating spaces, quotes, and case-sensitive quoted text. Also, leave a space after the IP address and before the last quotation mark in the second command.


Safely Sending a Log File

First, you will need to edit the file and remove all IP addresses and DNS names.

Scan the rest of the log file for confidential information. Indicate that you have removed the information for security reasons.

Before sending the log file to ISS or another organization for examination, encrypt the file or message to avoid unauthorized interception.

To send the log file to ISS, follow these steps:

  1. Send an e-mail to support@iss.net briefly stating the issue and requesting an incident number.

  2. Use one of the following methods to send your log file:

    • As an attached document in electronic mail.

    • As a file sent to the ISS FTP server.


Changing Risk Levels

Warning: Change risk levels at your own risk.

To change the Risk level in Internet Scanner, change the values in one of the database tables and in a file that is stored in the Scanner6 directory. The database is in \Program Files\ISS\Scanner6\Db, in the Vulns table. The field to edit is Severity. Assign values of High = 3, Medium = 2, and Low = 1.

The file that you may also want to modify is vulns.dbi. This file is used to rebuild the vulns table when the Internet Scanner database is initialized from the Internet Scanner main window by selecting Tools [image] Database Administration [image] Maintain.

To avoid having to redo changes to the Risk levels each time Internet Scanner is updated, you must manually merge old and new tables, and the custom Risk levels will have to be rekeyed.


Missing Raw Packet Driver

Explanation: Some of the testing techniques Internet Scanner uses require a spoofed packet. A spoofed packet uses an ‘origination’ IP address that has been faked. Normally, Windows NT does not allow this behavior. The ISS Raw Packet Driver allows Internet Scanner to conduct spoof-based tests on Windows NT systems.

The checks (and the vulnerabilities they report) that cannot be completed without the Raw Packet Driver are:

Policy Editor Folder | Vulnerability Check
Vulnerabilities [image] DNS | Dnsrev—DNS service reverse lookup
Vulnerabilities [image] Network | Udpbomb—SunOS can be crashed with malformed UDP packets
Vulnerabilities [image] Network | Land—Land denial of service attack
Vulnerabilities [image] Network | Syncstorm—SYN flood denial of service attack can crash machines or degrade performance
Vulnerabilities [image] Network | Teardrop—Teardrop IP fragmentation overlap
Services [image] TCP [image] Stealth Port Scan | Disable the Stealth Port Scan option.
Vulnerabilities [image] Protocol Spoofing | Rloginspoof—Rlogin vulnerable through TCP sequence prediction spoofing
Vulnerabilities [image] Protocol Spoofing | Rshspoof—Rsh vulnerable through TCP sequence prediction spoofing
Vulnerabilities [image] RPC | Pmapsunset—Portmap UNSET procedure requested with spoofed address


Office 95

Explanation: Sometimes after installing Internet Scanner, Office 95 fails to install properly. This is due to a DLL incompatibility.

Remedy: Rename %systemroot%\system32\ODBCJT35.DLL, install Office 95, then copy the original file over the one in the new Office installation.


Running on a Token Ring Network

Question: If I run Internet Scanner on a Token Ring, what are the performance differences?

Explanation: There are no performance differences other than those inherent across Ethernet and Token Ring topologies. However, Internet Scanner cannot perform some checks since the Raw Packet Driver can only bind to Ethernet network cards.


Running over Dial-up Networking or a Modem

Question: If I run Internet Scanner over a modem using Dial-up Networking, what are the performance differences?

Explanation: The main performance difference will be the amount of time needed to complete the scan. Depending on your modem speed, a scan may require significantly more time to complete than it would over a local area network.

In addition, the Raw Packet Driver can only bind to Ethernet protocols, therefore checks that use the Raw Packet Driver will not function. The checks that will not run are listed in the Missing Raw Packet Driver topic.


User Is Not Administrator

Scan Terminates If User Is Not Administrator

Explanation: Internet Scanner is capable of gathering a large amount of very sensitive information, as well as gathering password files. A user must be a member of the Administrators group to successfully run Internet Scanner on the local host. In addition, the user must have Domain Administrator rights to completely scan other computers on the network.

Remedy: Log in as an administrator-level user.


Too Many Users

Explanation: To minimize the load on memory, Internet Scanner does not cache users. Internet Scanner prevents more than 10,000 users from being displayed in the graphical user interface. All users will be correctly recorded in the database.

Remedy: Use a report or access the database to display the entire list of users on a host.


Incorrect Version of Windows

Explanation: The user interface requires items that were not available under Windows NT prior to 4.0, and Internet Scanner has not been tested under that version. Windows NT 3.51 has limited support for NetBIOS scans across large TCP/IP networks, and we have encountered several problems with Internet Scanner running under Windows NT 3.51 that we have been unable to resolve. For this reason, Windows NT 3.51 is no longer a supported platform. The first beta of Windows NT 4.0 was known to display a number of errors in Internet Scanner. Internet Scanner was not developed under the first beta, and has not been tested with that version of Windows NT. Due to these problems, Internet Scanner will not run under Beta 1 of Windows NT 4.0. Due to a lack of support for security, Internet Scanner also will not run under Windows 95.

Remedy: Obtain a supported version of Windows NT. Windows NT 4.0 is currently supported. Internet Scanner will run under beta 2 of Windows NT 4.0, but may display setup errors. It is strongly recommended that Internet Scanner be run on release versions of Windows NT. We also recommend applying the latest service pack.


Running Internet Scanner under Windows NT Server

Explanation: ISS recommends that you run Internet Scanner from a Windows NT workstation. As explained by Mark Russinovich at http://www.sysinternals.com/nt5.htm, the ‘quantum,’ or minimum time slice allocated to a thread in Windows NT varies between the workstation and server versions. Windows NT Server allocates 120 milliseconds per thread before it must be switched, and the Windows NT Workstation allocates between 10-30 milliseconds per thread depending on how the foreground priority boost is set. A shorter quantum tends to work better when a heavily threaded process, such as Internet Scanner, is running.

Another factor is how the two versions respond to demands from the console and the memory management strategies. Windows NT Workstation is optimized to be very responsive to the console, but not as responsive from the network. Windows NT Server is optimized to do the opposite. This can be seen on a heavily loaded server, where the operator might find managing users at the console to have unacceptably poor performance, but then be able to manage the same user database remotely from a workstation with reasonable performance. The memory management of a server tends to allocate proportionally more RAM to I/O cache, and less to free memory, and the workstation is again the opposite. Internet Scanner tends to spawn external processes and allocate large amounts of memory, both of which are activities that tend to favor Windows NT workstation.

Remedy: Due to the significant tuning differences between the two versions, ISS recommends that you run Internet Scanner on Windows NT Workstation. Note: Use Windows NT Server when you use a computer with more than two processors. Windows NT Workstation does not support more than two processors without a custom kernel from the hardware vendor. Windows NT Server can support up to four processors.


Windows NT 4.0 Beta

Explanation: After installation, Setup tries to create an “ISS Internet Scanner” program folder. Under Beta 2 of Windows NT 4.0, this will not succeed and a message box to that effect will display. However, you can create the program folder yourself without difficulty.

Remedy: Although Internet Scanner was largely developed under Windows NT 4.0 Beta 2, and is not known to display errors (except under Setup). ISS strongly recommends running Internet Scanner on release versions of Windows NT with the latest Service Pack.


Numerical Error Codes

Explanation: The error codes are hexadecimal values representing issues that prevent Internet Scanner from operating.

Remedy: If you encounter any of these errors while using Internet Scanner, you can analyze the Event Log of the scanning host to discover what caused the error. If you are unable to correct the problem using the information contained within the Event Log, use the procedure below to save the application event log and e-mail the file to ISS Support.

To send the event log to ISS Support, follow these steps:

  1. Send an e-mail to support@iss.net briefly stating the issue and requesting an incident number.

  2. From the Windows NT Start menu, select Programs [image] Administrative Tools (Common) [image] Event Viewer.

  3. From the Log menu, click Save As to display the Save As dialog box.

  4. Type the incident number that has been assigned to this problem. The .evt extension will be added automatically.

  5. Click Save.

  6. Insert the file as an attachment to an e-mail message and send it to support@iss.net.


OOB Check

Explanation: If this check is run against a vulnerable host, it will crash (blue screen) that host. If your computer is the scanning host and your computer is vulnerable, you will crash your computer.

Remedy: Apply the latest service pack and then apply the hotfix, both of which can be obtained from Microsoft’s Web site.


Socket Connection Hang

Explanation: When Windows NT attempts to make a socket connection, it sends out a SYN packet to the remote computer and waits for a reply. If no reply occurs within the timeout period (the default is three seconds), it then doubles the timeout period and retries the connection attempt. Every socket left open in this state consumes non-pageable kernel memory, and if too many sockets are not resolved, the host can run out of RAM. Since the problem is caused by non-pageable RAM consumption, Windows NT will essentially halt, and you will experience approximately two minute waits on response to toggling a caps lock key. The system will eventually recover, but it could take hours. ISS has advised Microsoft of this problem, and advised them that the amount of non-page pool that open sockets can consume should be a tuneable parameter. However, Microsoft has not (to the best of our knowledge) conceded that this is actually a problem, and to be fair, only an extremely intensive application such as Internet Scanner may be capable of reproducing this problem.

This problem typically occurs while scanning a network where ICMP traffic is filtered. If ICMP traffic is not filtered, the host machine can reply to a connection attempt with either a SYN-ACK (success), or an ICMP port unreachable. In either case, the connection attempt can be resolved.

Remedy: To avoid this potential performance degradation, follow these steps:

  1. Open the Registry editor (either regedit.exe or regedt32.exe).

  2. Locate the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters key, and insert the following values:

    • TcpMaxConnectAttempts, with type REG_DWORD, and a value of 3

    • TcpMaxConnectRetransmission, with type REG_DWORD, and a value of 3

  3. You must restart your system before these changes will take effect.

For additional information regarding these parameters, please refer to your Microsoft Windows NT Resource Kit.

Warning: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.


Solaris Inetd Loop

Explanation: When scanned, Solaris 2.4 machines sometimes fork off a new inetd process that goes into an infinite loop, causing the machine to slow down noticeably.

Remedy: Sun Patch ID #102922-04 at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.


Unusually Long Scan Times

Explanation: There are a number of factors that affect the speed of scans. Network speed, network traffic, and CPU speed of the scanning host can all have an impact on Internet Scanner’s performance. In addition, Internet Scanner includes a number of checks that can take a very long time to run. The following scans can be time-consuming:

  • Enumerating NetBIOS shares

  • Enumerating shares

  • Enumerating NFS mounts (in Vulnerabilities [image] Built-In Exploits [image] NFS, disable nfsexp or the NFS exports check)

  • Nbdict (dictionary attack against shares) (in Vulnerabilities [image] Built-In Exploits [image] Shares, disable nbdict)

  • Nbperm (password permutations) checks (in Vulnerabilities [image] Built-In Exploits [image] Shares, disable nbperm)

  • Password guessing and brute force attacks (disable all options in Vulnerabilities [image] Built-In Exploits [image] Brute Force)

  • Full Port Scans (under Common Settings [image] Port Scan, clear the Run Scan check box)

  • ICQClient—The ICQClient may bind at any port, causing inconsistent behavior from one boot to the next. The ICQClient check has been configured to scan the most likely ports, using a default port range from 1024 to 2124. Scanning this entire port range could take a considerable amount of time, as the check determines if the client is bound to a port somewhere within the default range. However, it is possible that the client may be bound outside the port range entered, which could result in a false positive.

  • IP Spoofing (disable all options in Vulnerabilities [image] Built-In Exploits [image] Protocol Spoofing)

  • Guessing Windows NT passwords against large domain controllers (under Common Settings [image] Brute Force Lists, clear the Use Default Login File check box)

  • SNMP checks (disable all options in Vulnerabilities [image] Built-In Exploits [image] SNMP)

  • Spoofing (disable Common Settings [image] IP Spoofing [image] Spoof Lists if you have lots of users and trusted hosts)

  • Stealth Scans (in Services [image] TCP [image] Stealth Port Scan, disable the Stealth Port Scan).

Remedy: Create a policy that eliminates any unnecessary lengthy checks. Also, run Internet Scanner from a host with sufficient CPU resources. The following items can be set in Internet Scanner to improve response time:

  • The default number of service scan threads is four. If your dial-up network is very slow, reduce this number to one for scanning across the connection.

  • If the initial host enumeration (gathered from pinging the network) is unreliable, make the following registry change:

    1. Open Registry Editor.

    2. Go to the HKEY_LOCAL_MACHINE/SOFTWARE/ISS/Internet Scanner/6.0/Config key, and reduce the PingSendWaitCount value. The default is 64.

    3. Raise or lower this number by a factor of 2.

Warning: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.


A Thorough Battery of Tests

Much research has gone into the implementation of a thorough battery of system-probing tests. Even experts may overlook some of the backdoors and weaknesses that a persistent and clever intruder might exploit. Internet Scanner cannot exhaust all possible attack scenarios. However, it will certainly provide an extra level of protection through increased awareness of network vulnerabilities.


About ISS Scanner

About Internet Scanner

Displays version and copyright information about Internet Scanner.


Active Ping

Displays data when pinging the network.


Add Policy

Lets you define a custom set of checks in a new policy. Useful when no policy meets your current requirements. Starts the New Policy Wizard.


Automated Scanning

Internet Scanner probes automatically. It examines hosts, services, ports, daemons, and domains—snooping around where a potential attacker might—much more efficiently than a human can. While there is no replacement for vigilance, this security tool greatly enhances an administrator’s chances of locating vulnerabilities.


High

Any vulnerability that allows an attacker to gain immediate access into a machine, to gain superuser access, or to bypasses a firewall. Example: A vulnerable Sendmail 8.6.5 version that allows an intruder to execute commands on mail server.


Tips & Tricks

Many tests used by Internet Scanner push the limits of the system’s operation, looking for vulnerabilities. While you are planning or implementing a test plan, consider these issues:

  • Notify Users—Notify individuals of scanned devices before you start scanning. This way, system owners know which scans are authorized, and can take action and make improvements based on the scan results.

  • Vary Scan Times—Run scans at various times of the day and the week to improve the chances of accessing systems that may be unavailable at certain times.

  • Run unscheduled scans on verified systems—After a network is known to be secure, use occasional unscheduled scans to maintain the secure state of the network. Only run unscheduled scans against systems that have passed a scheduled scan.

  • Scan new systems as soon as possible—Scan new systems as soon as possible after adding them to a secure network. Do this in cooperation with the parties responsible for the system and network connectivity.

  • Scan selectively—Allow systems to opt out of scans if special needs, circumstances, or justifications (such as pending upgrades) are in effect.

  • Schedule Denial of Service checks cautiously—Schedule Denial of Service tests, which are known to cause system interruptions in vulnerable systems, after you have notified the system owner.

  • Identify critical systems and services—Contact your vendors or security agencies to obtain corrective actions and advisories if Internet Scanner uncovers an unknown vulnerability. Obtain updates for Internet Scanner at the ISS Web site at http://www.iss.net.


Add/Edit Known Accounts

  • Add an account

  • Edit an account


FlexChecks

Using FlexChecks

The FlexChecks™ feature lets you create, edit, or delete custom user-defined checks or FlexChecks that scan specific network environments for vulnerabilities or conditions not currently scanned by Internet Scanner. To run a FlexCheck, you must develop an executable written in the C language or written as a Perl script.

Dialog Box Elements

Element

Description

Check Name

The user-defined name for the FlexCheck you create.

Executable

The executable (.exe) file for the FlexCheck you create.

Add

Lets you add or create a FlexCheck, which displays as an entry in the FlexChecks folder on the Policy Editor folder tree.

Check Name: The user-defined name for the FlexCheck you create.

Executable: The executable (.exe) file for the FlexCheck you create.

Arguments: The command-line arguments passed to the executable file during a scan. Before launching the executable for the host, Internet Scanner appends the IP address for each scanned host to the argument.

Timeout (secs): The number of seconds that each instance of the executable is allowed to run.

Info: Lets you type details about your custom check, including a description of the vulnerability and its fix information.

Edit

Lets you modify a FlexCheck.

Delete

Lets you remove a FlexCheck from Internet Scanner.

Internet Scanner provides CustomTest.exe designed to test the functionality of the FlexCheck engine. The Custom Test check does not rely on scanning a host to function, and uses the following arguments to vary scan results: pos, neg, fail, and timeout. See Running the Custom Test check from the Command Line or Running the Custom Test check from the User Interface.

Important: ISS does not support the functionality of the FlexChecks you create, but we do provide technical support for the FlexCheck engine that runs your FlexCheck. If your FlexCheck does not run, and you suspect that the FlexCheck engine is the cause, please use the Custom Test check included with Internet Scanner to test your FlexCheck engine. See Running the Custom Test check from the Command Line or Running the Custom Test check from the User Interface.

If the FlexCheck engine does not work after using the Custom Test check, please e-mail support@iss.net for assistance.

Related Topics


Accounts Table

Lists the account ID, the host ID, the account name, and the account type (user account, group account, or machine account) for each account scanned during a scan session.


Host Table

Lists the host ID, the IP address, the DNS name, the NetBIOS name, and the NetBIOS domain for each host scanned during a scan session.


Jobs Table

Lists the job ID, the start time, the stop time, the session name, and the host name for each scan session run by the Scanner.


Services Table

Lists the service ID, the service ports, the service keyword, the service type, and the service description for services that can be found during a scan session.


Vulnerabilities Table

Lists the vulnerability ID, the vulnerability name, the vulnerability severity, the vulnerability risk level, and a description for all vulnerabilities found during a scan session.


History Tab

Shows the history of the data files in the database when resource modules or exploit modules are installed.

The information displayed includes the version number that the new modules were installed under, the date of the installation, the number of vulnerabilities in each module, and what occurred in the database.


Modules Tab

Lists the built-in resources and the plug-in resources, and the built-in exploits and the plug-in exploits that Internet Scanner can use during a scan session.


Charts Tab

Displays risk level information graphically for the built-in exploits and the plug-in exploits.


Keyword Search

The Use Search option lets you search for keywords or keyword phrases in the Policy Editor. After displaying the results of the keyword search in the Policy Editor’s folder tree, you can enable the vulnerability checks containing the keywords or keyword phrases for your policy.


Delete Policy

Select the icon for the policy you want to delete and click Delete. Only the custom policies appear in the list, because the built-in policies cannot be deleted.

Internet Scanner deletes the policy and removes the icon from the list of available policies.

The Delete command remains disabled until all sessions have been closed. If you delete the policy and a saved session references this policy, then you will have to select a new policy.


New Policy Wizard - Name the New Policy

Type a unique name for your new policy. Policy names can include spaces and can be up to 256 characters long. Click Finish to complete the New Policy Wizard. Your new policy is displayed in the Policy Select dialog box.


New Policy Wizard - Policy Select

Select the icon for the policy you want to use or modify and click Next. Internet Scanner applies the policy to the new session.

Your custom policies appear alongside the default policies, which are as follows:

  • L1 Inventory

  • L2 Classification

  • L2 Database Discovery

  • L3 Desktop

  • L3 NT Server

  • L3 NT Web Server

  • L3 Router & Switch

  • L3 Unix Server

  • L3 Unix Web Server

  • L4 NT Server

  • L4 NT Web Server

  • L4 Router & Switch

  • L4 Unix Server

  • L4 Unix Web Server

  • L5 NT Server

  • L5 NT Web Server

  • L5 Unix Server

  • L5 Unix Web Server


Policy Properties

Lets you set up permissions to edit or to delete the policy, and lists the built-in exploits and the plug-in exploits enabled for the policy.


New Policy Wizard

The New Policy Wizard guides you through the process of creating a policy based on an existing policy.

These default policies are provided:

  • L1 Inventory

  • L2 Classification

  • L2 Database Discovery

  • L3 Desktop

  • L3 Router & Switch

  • L3 NT Server

  • L3 NT Web Server

  • L3 Unix Server

  • L3 Unix Web Server

  • L4 Router & Switch

  • L4 NT Server

  • L4 NT Web Server

  • L4 Unix Server

  • L4 Unix Web Server

  • L5 NT Server

  • L5 NT Web Server

  • L5 Unix Server

  • L5 Unix Web Server

They can be used as is, or modified to suit your needs. Any policies that you have created or modified are also present in the list of icons.

Related Topics


Exploits Tab

Displays information for each installed exploit on the system, including the vulnerability ID, the exploit name, the X-Force database tag name, the vulnerability category, the risk level, and the OS affected.

Click any of the column headers to sort the listed items based on that column.

Right-click any of the column headers to print a list of the exploits based on that column, or to copy the exploit information to your system’s clipboard and drop the information into an Excel spreadsheet.


Preview Reports

Displays a screen version of your report as it will look when printed, including detailed information on the report’s content.


Select Hosts

Type topic text here.


Edit Current

Allows you to edit the policy of the currently selected scan session.


Enter Hosts

Enter the hosts you want to scan, or select from the list. Hosts can be entered in the following combinations, where “IP” represents a dotted IP address (such as 127.0.0.1):

IP,IP: two separate hosts

IP-IP: a range of hosts

IP-IP,IP: a range and a single host

IP-IP,IP-IP: two (or more) ranges

Any number of ranges and individual hosts may be combined. No spaces are permitted.

Load Values From Key: Loads the allowed scanning range into the edit control from the selected key. If a key contains several ranges, it may be easier to edit the ranges than to type them in manually.

Related Topics


fail

Force the check to fail.


Fully Configurable

Internet Scanner is configurable and therefore adaptable to your particular network. Using Policies and Sessions, you can select which vulnerabilities to test and which networks and/or machines to scan. If you need to track changes in your network, Internet Scanner’s analytic capability can be leveraged to display trends in activity or vulnerabilities over time.


How Internet Scanner Works

Internet Scanner performs a pre-configured battery of tests that range from information-gleaning exercises to outright exploits. Internet Scanner finds vulnerabilities much as an intruder would—by examining various hosts, services, domains, and other elements of TCP/IP networks. The automation and comprehensive testing Internet Scanner provides offer several important advantages over unassisted administrator vigilance, including speed, ease of use, and comprehensiveness.


ip-address

The IP address of a given host in a scan.


List View Accounts Tab

The List View Accounts Tab displays the host and network information for each user account, group account, or machine account on the scanned hosts. Click any of the column headers to sort the listed items based on that column. (A machine account exists on a Windows NT Domain Controller.)

List View Item | Description
Host | The IP address of the scanned host.
Account Name | The name of the user account, group account, or machine account as defined in User Manager. User accounts are typically acquired from Finger Output, RPC Users, and Windows NT user enumeration.
Account Type | Additional account information if available.


Properties View

Displays the Properties tab in the List View.


List View Services Tab

The List View Services Tab displays the services detected, and for each host lists the service name and their port numbers. Click any of the column headers to sort the listed items on that column.

List View Item | Description
Host | The IP address of the scanned host.
Service Name | The name of the service.
Port # | The port associated with the service. Native Windows NT services are not associated with a specific port.
Protocol | The protocol that the service uses to connect to the port.


List View Status Tab

The List View Status tab displays the host being scanned and its scanning status. Click any of the column headers to sort the list by that column.

List View Item | Description
Host | The IP address of the selected host.
Status | Displays the progress of the scan, and shows the order of the exploits.
Time | Shows the time each exploit began.


List View Vulnerabilities Tab

The List View Vulnerabilities tab displays each detected vulnerability and lists the potential vulnerabilities, risks, and a description of the vulnerability. Click any of the column headers to sort the items based on that column.

List View Item

Description

Host

The IP address of the host.

Vulnerability Name

The short label associated with this vulnerability.

Risk

The risk level associated with the vulnerability:

  • A high risk vulnerability allows unauthorized access to the host.

  • A medium risk vulnerability allows an intruder to gather critical information that could lead to unauthorized access.
  • A low risk vulnerability gives the intruder information about the host.

Description

A short description of the vulnerability. To display a full explanation, right-click the vulnerability, or select the vulnerability and press F1.


Add Host

Adds a host to the current session.


Viewing the Credits

Displays a list of the people who brought you Internet Scanner.

To display the credits, follow these steps:

  1. From the Internet Scanner main window, select Help [image] About Internet Scanner to display the About Internet Scanner window.

  2. Click Credits to display the Credits window.


Apply Existing

Lets you apply an existing policy to a previously configured session.


Database Administration

Displays the Database Administration dialog box used to select data sources and view tables.

See Database Administration.


Remove Host

Removes the selected host or hosts from the current session.


Display Key

Displays the Display Key dialog box.


Close Session

Closes the current session. If you have not saved the session, you are prompted to do so.


Open From Database

Displays the Open from Database dialog box used to open previously performed scans.


Delete

Displays the Delete Policy dialog box.


Delete Session

Browse through saved session files and select the session you want to delete.


Edit Policy

Select the icon for the policy you want to edit. You can edit default and custom policies.


Exit

Exit the Internet Scanner program. Internet Scanner lets you save changes to sessions before exiting.


Export Host File

Saves the host’s IP address and name in a .hst host text file. From the Save As dialog box, select the location and file name of a host file to be created.


New Session

Creates a new session. Then the New Session Wizard guides you through configuring an Internet Scanner session.


New

Displays a series of dialog boxes that guide you through the creation of a new Policy.


Open From File

Displays the Open dialog box used to open a previously saved session (.session file name extension).


Save Session

Saves the current session as is to its current directory.


Save Session As

Displays the Save As dialog box used to specify a new name or location for the current scan session.


Help Topics

Contents and Index

Displays the Contents page of this help system. Click the Search tab at the top of the Contents page to access a dialog box where you can enter words relating to topics of interest.


Product Update

Directs your Web browser to a page at the ISS Web site for product information and updates on current shipping versions.


About

Provides a list of Internet Explorer and HTML Help-related DLLs and their version information.


Using the Policy Editor

Provides information on the Policy Editor, including information about the user interface and general procedures for using the Policy Editor.


Close

Closes the Policy Editor.


Save

Saves the current policy.


Save As

Saves the current policy with a new policy name.


Help at Top

Places the embedded vulnerability help information at the top of the Policy Editor window.


Refresh

Updates the current view in the Policy Editor.


Properties

Displays the Properties dialog box, which lists the vulnerabilities enabled for a policy.


Generate Report

Opens the Reporting Wizard. Both text and HTML reports may be generated from any log file.

For more information, see:

  • Generate Reports - Select Report

  • Generate Reports - Report Criteria

  • Generate Reports - Summary


Select Report to Import

Import Custom Report

Displays a Browse dialog box for navigation to the Custom Report you want to import.


Console Mode Scan

Using the current policy, Internet Scanner performs the scan from the command line. Use the console mode for very large networks or scans, or when you want to eliminate the overhead of the user interface.


Scan Now

Starts the scan for the currently selected session.


Pause Scan

Pauses the current scan indefinitely.


Resume Scan

Resumes the current paused scan.


Stop Scan

Ends the current scan. This should only be used as an emergency measure, since it cannot be restarted. If you stop a scan, Internet Scanner saves the session contents and closes the application.


FlexChecks

Displays the FlexChecks dialog box used to create, modify, or delete user-defined checks (or FlexChecks).

See FlexChecks.


Edit Known Accounts

Displays the Known Accounts dialog box used to create, modify, or delete Window NT accounts that SmartScan has cracked or will attempt to crack during a scan session.

See Edit Known Accounts.


Options

Displays the Options dialog box used to set Internet Scanner general performance settings and file location options.

This dialog contains two tabs: Scanner and File Locations.

  • Scanner tab

  • File Locations tab


Account Tree

Displays the Accounts tab in the Tree View.


Account View

Displays the Accounts tab in the List View.


Show All Hosts

Displays all hosts in the Tree View.


Session Data View

Displays session information as the scan takes place.


Host Tree

Displays the Host tab in the Tree View.


Installed X-Press Modules

Displays the properties for each X-Press Module (Resource Module or Exploit Module) installed on the system.

The information that is displayed includes:

  • an area of module information, exploit information, and properties for each Resource Module and each Exploit Module installed on the system, and

  • a list of all the exploits (built-in or plug-in) installed on the system, including the exploit’s name, the exploit’s vulnerability category, the operating systems affected by the exploit, the exploit’s DLLs, and the exploit’s version history.


Real Time Mode

Updates the Tree View and the List View in real time. (Not recommended for large networks.)


Refresh

Updates the current view.


Services Tree

Displays the Services tab in the Tree View.


Services View

Displays the Services tab in the List View.


Status View

Displays the Status tab in the List View.


Toolbars

Two toolbars are available in Internet Scanner, depending on whether or not you have a session selected. For more information, click on the following links.

No Session Selected

Session Selected


Vulnerability Tree

Displays the Vulnerabilities tab in the Tree View.


Vulnerability View

Displays the Vulnerabilities tab in the List View.


Arrange Icons

Resets minimized sessions to defaults.


Cascade

Displays the List View and the Tree View as overlapping windows.


Tile

Displays the List View and the Tree View as non-overlapping stacked windows.


neg

Do not find the vulnerability.


NIS Domain Name

Type the domain name that you want the NIS Domain Name scan to guess.


Other RPC Services

Note: If this information appears in a popup window and you want to go to other topics, please use the Help button from the RPC policy settings tab.

3270_mapper: See 3270 mapper Service Running.

admind: This check also detects the sadmind service. See Admind or Sadmind Service Running.

alis: See RPC alis Service Running.

bootparam: See Boot Parameter (bootparam) Running and Bootparam Supplies Domain Name.

database_svc: See RPC Database Service Running.

etherstatd: See Etherstatd Service Running.

irixfam: See IRIX FAM Server Allows Attackers to List Files.

keyserv: See RPC keyserv Service Running.

llockmgr: See RPC llockmgr Service Running.

mountd: See Mountd Service Running.

nfsd: See Nfsd Service Running

nlockmgr: See RPC nlockmgr Service Running.

nsed: See Nsed Service Running.

nsemntd: See Nsemntd Service Running.

rexd: See Rexd Service Running.

rje_mapper: See Rje mapper Service Running.

rquotad: See Rquotad Service Running.

sadmind: This check also detects the admind service. See Admind or Sadmind Service Running.

sched: See Sched Service Running.

showfhd: See Showfhd Service Running.

snmp: See SNMP Running.

sprayd: See Sprayd Service Running.

statmon: See RPC statmon Service Running.

sunlink_mapper: See Sunlink Mapper Service Running.

tfsd: See Tfsd Service Running.

ugidd: See UGIDD Running.

walld: See Walld Service Running.

x25.inr: See X25 Service Running.

ypbind: See Ypbind Service Running.

yppasswdd: See Yppasswdd Service Running.

ypserv: See Ypserv Service Running.

ypxfrd: See Ypxfrd Service Running.


Policy Alteration

Choose from the following options when modifying a policy:

Make Changes Temporarily (Do not save Policy): Enables the changes for this session, but does not store them permanently.

Save Changes To Template: Saves the changes to the current template. Note: These changes are permanent.

Create a new template with these properties: Saves the current settings to a new policy. You will be prompted to name the new settings template.

Discard Changes: Discards any changes made to the current policy for the scan session.


Policy Settings

Internet Scanner’s policy settings let you select the checks that you want to perform. Each policy represents a different category of vulnerability. Policy files are stored in the Policy folder located in the directory where you installed Internet Scanner. The default policies that ship with Internet Scanner are targeted towards specific operating systems, system types, and system use.

These default policies are shipped with Internet Scanner:

  • L1 Inventory

  • L2 Classification

  • L2 Database Discovery

  • L3 Desktop

  • L3 Router & Switch

  • L3 NT Server

  • L3 NT Web Server

  • L3 Unix Server

  • L3 Unix Web Server

  • L4 Router & Switch

  • L4 NT Server

  • L4 NT Web Server

  • L4 Unix Server

  • L4 Unix Web Server

  • L5 NT Server

  • L5 NT Web Server

  • L5 Unix Server

  • L5 Unix Web Server

You can customize the policies you use to scan your network. Creating custom policies offers many advantages. For example, if your network contains a segment that has only Windows NT machines, you might want to create a policy that turns off Unix-only checks. This configuration increases Internet Scanner’s speed and performance by eliminating unnecessary vulnerability checks. Caution: Many Unix services (such as NFS) can be installed on Windows NT computers, and will not be reported if all Unix checks are disabled. For more information on creating your own policies, see Creating Custom Policies.


pos

Find the vulnerability.


Recent sessions

Select from a list of recently opened sessions.


Policy Editor

The Policy Editor window displays the following areas:

  • a menu bar and a toolbar,

  • a Folder Tree, which lists the configurable settings that you can enable when you set up a policy,

  • an area for searching on a keyword or a keyword phrase, which enables vulnerability checks or other settings in the policy that contain the keywords,

  • an area for enabling vulnerabilities for the policy and for configuring vulnerabilities that have additional property settings, and

  • a browser-enabled Vulnerability Information window.

Vulnerability Catalog

The Vulnerability Catalog contains the help information for all the vulnerability checks used in Internet Scanner. This information is identical to the help information embedded in the Policy Editor’s Vulnerability Information window. The search engine used by the Vulnerability Catalog help file lets you target your search towards keywords that may be present in the help information of multiple vulnerability checks.


Select Policy List

Click one of the policies listed in this window to display, use, or change the configuration settings.

Your custom policies appear alongside the default policies, which are as follows:

  • L1 Inventory

  • L2 Classification

  • L2 Database Discovery

  • L3 Desktop

  • L3 Router & Switch

  • L3 NT Server

  • L3 NT Web Server

  • L3 Unix Server

  • L3 Unix Web Server

  • L4 Router & Switch

  • L4 NT Server

  • L4 NT Web Server

  • L4 Unix Server

  • L4 Unix Web Server

  • L5 NT Server

  • L5 NT Web Server

  • L5 Unix Server

  • L5 Unix Web Server


Status Bar

Displays status bar messages when selected.


Summary

The final step of the Database Wizard lets you review the selections you made in the previous steps. If you are unsatisfied with any of your selections, click Back to return to the section that you want to change. Click Finish to create the new data source and return to the Database Administration dialog box.


Telnetd Environment Workaround

This information is from CERT Advisory CA-95:14 “Telnetd Environment Vulnerability,” Appendix B available from ftp://ftp.cert.org/pub/cert_advisories/CA-95:14.Telnetd_Environment_Vulnerability.

/*
* This is a login wrapper that removes all instances of
* various variables from the environment.
*
* Note: this program must be compiled statically to be
* effective against exploitation.
*
* Author: Lawrence R. Rogers
*
* 10/25/95 version 1.1 Original version
* 10/26/95 version 1.2 ELF_ variables removed (Linux)
* 10/27/95 version 1.3 ELF_ changed to ELF_LD_
* Added AOUT_LD_ (Linux)
*
*/

#include <stdio.h>

#if !defined(_PATH_LOGIN)
# define _PATH_LOGIN “/bin/login.real”
#endif

main (argc, argv, envp)
int argc;
char **argv, **envp;
{
register char **p1, **p2;

for (p1 = p2 = envp; *p1; p1++) {
if (strncmp(*p1, “LD_”, 3) != 0 &&
strncmp(*p1, “_RLD”, 4) != 0 &&
strncmp(*p1, “LIBPATH=“, 8) != 0 &&
strncmp(*p1, “ELF_LD_”, 7) != 0 &&
strncmp(*p1, “AOUT_LD_”, 8) != 0 &&
strncmp(*p1, “IFS=“, 4) != 0 ) {
*p2++ = *p1;
}
}
*p2 = 0;
execve(_PATH_LOGIN, argv, envp);
perror(_PATH_LOGIN);
exit(1);
}

The following two examples show how to compile the login-wrapper for SGI’s IRIX 5.3 and FreeBSD 2.x systems. The examples move the distributed login program to a new location and install the wrapper in the standard location. When executed, the wrapper first cleanses the environment and then calls the relocated, distributed login program.

Note 1: The wrapper must be compiled statically. On SGI’s IRIX system, compiling statically requires that the non-shared versions of libraries be installed. Refer to your system documentation to determine how to do this.

Note 2: You may need to change the _PATH_LOGIN variable to define where the real login program resides on your system. On some systems, login resides in /usr/bin/login.

Compiling for IRIX 5.3:

# uname –a
IRIX test 5.3 11091812 IP22 mips
# /bin/ls -l /usr/lib/iaf/scheme
- -rwsr-xr-x 1 root sys 65832 Sep 9 14:24 /usr/lib/iaf/scheme
# /bin/cc -non_shared -O -D_PATH_LOGIN=\”/usr/lib/iaf/scheme.real\” \
login-wrapper.c -o login-wFrapper
# /bin/mv /usr/lib/iaf/scheme /usr/lib/iaf/scheme.real
# /bin/chmod 755 /usr/lib/iaf/scheme.real
# /bin/mv login-wrapper /usr/lib/iaf/scheme
# /bin/chmod 4755 /usr/lib/iaf/scheme
# /bin/chown root /usr/lib/iaf/scheme
# /bin/chgrp sys /usr/lib/iaf/scheme
# /bin/ls -lL /usr/lib/iaf/scheme /usr/lib/iaf/scheme.real
- -rwxr-xr-x 1 root sys 65832 Sep 9 14:24
/usr/lib/iaf/scheme.real
- -rwsr-xr-x 1 root sys 213568 Oct 30 08:42 /usr/lib/iaf/scheme

Compiling for FreeBSD 2.x:

# /bin/ls -lg /usr/bin/login
- -r-sr-xr-x 1 root bin 20480 Jun 10 20:00 /usr/bin/login
# /usr/bin/cc -D_PATH_LOGIN=\”/usr/bin/login.real\” -static \
-O login-wrapper.c -o login-wrapper
# /bin/mv /usr/bin/login /usr/bin/login.real
# /bin/chmod 555 /usr/bin/login.real
# /bin/mv login-wrapper /usr/bin/login
# /bin/chmod 4555 /usr/bin/login
# /usr/sbin/chown root.bin /usr/bin/login
# /bin/ls -lg /usr/bin/login /usr/bin/login.real
- -r-sr-xr-x 1 root bin 24885 Oct 25 22:14 /usr/bin/login
- -r-xr-xr-x 1 root bin 20480 Jun 10 20:00 /usr/bin/login.real


timeout

Force the check to time out.


To add an account to the Known Accounts file

  1. From the Internet Scanner main window, select Tools [image] Edit Known Accounts to display the Known Accounts dialog box.

  2. Click Add to open the Add Known Account dialog box.

  3. In the User Name box, type a user name for the account you want SmartScan to attempt to crack.

  4. In the Domain Name box, type the user’s domain.

  5. In the Password box, type the user’s password.

  6. Select the Verified check box if you are certain that the password in the Password box is correct. However, if you are unsure whether the password in the Password box is correct, clear the Verified check box and add unverified passwords to the user account so that SmartScan will use these additional passwords as it attempts to crack the account.

    Important: If a password for a user account becomes verified, all other passwords for the account are deleted from the Known Accounts file. A user account may have several unverified passwords, but only one verified password. You may add unverified passwords for a user account, even if it is a verified account, but once the given account’s password is found to be correct, all other passwords are deleted.

  7. Click OK to add the account-password pair, and exit the Add Known Account dialog box.

  8. Click Exit to exit the Known Accounts dialog box, and return to the Internet Scanner main window.


To apply the latest Windows NT Service Pack

  1. Open a Web browser.

  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.

  3. Find the installation program you downloaded to your computer.

  4. Double-click the program icon to start the installation.

  5. Follow the installation directions.


To create a FlexCheck written in PERL

To create a custom check written in Perl:

  1. From the Internet Scanner main window, select Tools [image] FlexChecks to display the FlexChecks dialog box.

  2. Click Add to open the Add FlexCheck dialog box.

  3. In the Check Name box, type <the vulnerability name>.

  4. In the Executable box, type the directory path or browse for the location of the directory containing the executable that installs the Perl program.

  5. In the Arguments box, type the path of the directory containing the Perl script that runs the executable for your FlexCheck.

  6. In the Timeout (secs) box, type a timeout value.

  7. In the Info box, type details about the vulnerability, including a description and its fix information.

  8. Click OK to apply the settings.

  9. The Add FlexCheck dialog box displays the check information for the FlexCheck you created.

  10. The FlexChecks dialog box displays the FlexCheck you created, along with a list of FlexChecks previously created and included in Internet Scanner.


To create a FlexCheck written in the C Language

  1. From the Internet Scanner main window, select Tools [image] FlexChecks to display the FlexChecks dialog box.

  2. Click Add to open the Add FlexCheck dialog box.

  3. In the Check Name box, type <the vulnerability name>.

  4. In the Executable box, type C:\Program Files\ISS\Scanner6\Custom\*.exe as the directory location of your FlexCheck’s executable.

  5. In the Arguments box, type command-line arguments that will be passed to the executable during the scan.

  6. In the Timeout (secs) box, type a timeout value.

  7. In the Info box, type details about the vulnerability, including a description and its fix information.

  8. Click OK to apply the settings.

  9. The Add FlexCheck dialog box displays the check information for the FlexCheck you created.

  10. The FlexChecks dialog box displays the FlexCheck you created, along with a list of FlexChecks previously created.


To create and import a custom report:

  1. Copy the existing report (*.rpt file) to a working area. Give the new report a unique name. Reports are stored in the Reports directory where you installed Internet Scanner.

  2. Use Crystal Reports 7.0 to edit the new copy of the report.

  3. From the Internet Scanner main window, select Reports [image] Import Custom Report.

  4. Select the new report from your working area. Click Open.

  5. From the Import Custom Report dialog box, select how and where the report appears. Click OK to import the report.


To create multiple data sources

  1. From the Internet Scanner main window, select Tools [image] Database Administration to display the Database Administration dialog box.

  2. Click New DSN to start the Database Wizard. From the Select a Data Source dialog box, enable the Create a new data source option and click Next.

  3. From the Create a New Data Source dialog box, select Microsoft Access and click Next.

  4. From the Name the Data Source dialog box, type a name for your new data source.

    For additional security, you can assign an optional User Name and Password. If you previously configured your database software to require a username and password, you must enter the same information here.

  5. Click Next to display the Selection Review dialog box.

  6. Click Finish to begin loading the database tables for your new data source into the Scanner.

  7. Once the new data source appears in the Database Administration dialog box, click OK to accept the new data source and exit the Database Administration dialog box.

    —OR—

    To create additional data sources, repeat steps 2 through 7.


To delete a FlexCheck

  1. From the FlexChecks dialog box, select a FlexCheck and click Delete. A message box warns you that deleting a FlexCheck from Internet Scanner is an irreversible action.

  2. Click Yes to delete the FlexCheck.


To delete an account from the Known Accounts file

  1. From the Known Accounts dialog box, select a user account and click Delete. The Delete Domain/User Password message box asks if you want to delete the user account from the Known Accounts file.

  2. Click Yes to delete the user account.


To edit a FlexCheck

  1. From the FlexChecks dialog box, double-click the FlexCheck or select the FlexCheck and click Edit. The Edit FlexCheck dialog box displays the information you included for your FlexCheck.

  2. Edit the FlexCheck's information, where appropriate.

  3. Click OK to apply the changes.


To edit a host file:

  1. Open the file in a text editor, such as Notepad.

  2. A host’s file is required to have the IP address starting in the first column of the file, with one IP address per line. Any lines beginning with either a space or a # sign are ignored as a comment. Any hosts that are outside the scan range are also ignored. The number of hosts that may be loaded is limited only by available memory and your scan range.

    For example, this .hst (host) file is set up to scan three devices:

    129.0.0.45
    #129.0.0.46 (do not scan)
    129.0.2.102
    129.0.2.103

  3. Save the host file.


To edit an account in the Known Accounts file

  1. From the Known Accounts dialog box, double-click a user account or select a user account and click Edit. The Edit Known Account dialog box displays the user’s name, the user’s domain name, the user’s password, and the user’s password status.

  2. Edit the user account information where appropriate.

  3. Click OK to apply the changes.


To export a host file

  1. From the Internet Scanner main window, select File [image] New Session to start the New Session wizard.

  2. On the Specify Hosts dialog box, select Ping All Valid Hosts in Your Key Range and click Next.

  3. On the Ping Range dialog box, you can either click Finish to ping every host within your key range, or click Edit Range to exempt specific hosts from this file.

  4. Complete the wizard by clicking Finish. Internet Scanner pings the range of hosts.

  5. From the Internet Scanner main window, select File [image] Export Host File to save a version of the host file. Host files are saved with a .hst file name extension in the directory of your choice.

  6. Once you have exported a host file, it can be edited directly. This allows you to use Internet Scanner’s command-line option to quickly access the specific list of hosts you want to scan.


To run a scan using a new data source

  1. From the Internet Scanner main window, select Tools [image] Database Administration to display the Database Administration dialog box.

  2. Click New DSN to start the Database Wizard. From the Select a Data Source dialog box, enable the Select an existing data source option and click Next.

  3. From the Select an Existing Data Source dialog box, select the new data source from the list and click Next.

  4. From the Name the Data Source dialog box, type the username and the password if you previously configured your database software to require this information, and click Next.

  5. From the Selection Review dialog box, select No to preserve the data in the selected data source.

  6. Click Finish to return to the Database Administration dialog box.

  7. Click OK to exit the Database Administration dialog box.


To run the Custom Test check from the command line

At a command line, type:

customtest.exe [pos|neg|timeout|fail] [<timeout-value>]<ip-address>

To vary the scan results of the Custom Test check, run the custom checks engine on separate occasions with each of these arguments (pos, neg, timeout, or fail).

Using the <timeout-value> argument and the <ip-address> argument is optional. However, if you want to test the timeout functionality of the custom checks engine, use the following method:

In the <timeout-value> field, type timeout-x. For example, type timeout-40. The Custom Test will sleep for 40000 milliseconds (40 seconds) + 1000 milliseconds (1 second), or 41 seconds, forcing the custom checks engine to time out.


To run the Custom Test check from the user interface

  1. From the Internet Scanner main window, select Tools [image] FlexChecks to display the FlexChecks dialog box.

  2. Click Add to open the Add FlexCheck dialog box.

  3. In the Check Name field, type the <check name>.

  4. In the Executable field, type C:\Program Files\ISS\Scanner6\Custom\CustomTest.exe as the directory location of the Custom Test executable.

  5. In the Arguments field, type pos, neg, timeout, or fail.

  6. (optional) In the Timeout (secs) field, type a timeout value.

  7. (optional) In the Info field, type details about the vulnerability, including a description and its fix information.

  8. Click OK to apply the settings.


To send a log file via e-mail:

  1. Using your e-mail program, create an e-mail document.

  2. Address the message to support@iss.net.

  3. In the Subject heading, type the incident number that has been assigned to this issue.

  4. Attach the log in the e-mail message. By default, the log is in the \Program Files\ISS\Scanner6\log directory.

  5. Click Send.


To send a log file via FTP:

  1. Start your FTP client program.

  2. Open a connection to ftp://ftp.iss.net/incoming.

  3. Name the log after your incident number. If you do not have an incident number, contact ISS Support at support@iss.net. By default, the log is in the \Program Files\ISS\Scanner6\log directory.

  4. Contact ISS Support at the address listed in step 3 to indicate that the log is on the FTP server.


To start Registry Editor:

  1. From the Windows NT Start menu, select Run.

  2. Type regedt32.

  3. Click OK.

  4. Click the window name that corresponds to the registry key you need to view or edit. For example, click the HKEY_LOCAL_MACHINE window to work with a key or value in that hierarchy.


Toolbar

When selected, displays the toolbar at the top of the Internet Scanner main window.


Tree View Accounts Tab

The Accounts tab displays user accounts, group accounts, or machine accounts that were detected by Internet Scanner. Intruders could use this information to log in to the vulnerable machine. (A machine account exists on a Windows NT Domain Controller.)


Tree View Hosts Tab

The Hosts tab displays the hosts loaded in the current session of Internet Scanner.

If more than one subnet is loaded, the Host View can be expanded or collapsed by clicking the plus sign or the minus sign, respectively. Select any subnet or host to display the properties in the List View for the selected item. By clicking a host entry, you can quickly review the vulnerabilities, services, or accounts found during a scan or within a saved session.

When you click a host in the Tree View, the List View (to the right of the Tree View) displays tabs if host properties, scan status, services, vulnerabilities, and accounts are present.


Tree View Services Tab

The Services tab displays the Services running on the machine at the time it was scanned. To display an explanation of selected services, right-click any of the listed services. Native Windows NT and custom services display the List View Services Tab topic. To display the IP address or addresses where the service was detected, click the plus sign beside the service.


Tree View Vulnerabilities Tab

The Vulnerability tab displays the vulnerabilities detected by Internet Scanner. Clicking a vulnerability item displays which hosts have been found to be vulnerable. To display an explanation of the vulnerability, right-click any of the listed vulnerabilities. To display the IP address or addresses where the vulnerability was detected, click the plus sign beside any vulnerability.

Selecting Real Time Mode in the View menu lets you view vulnerabilities as they are detected, as Internet Scanner checks each IP address. This option is not recommended for large networks.


Troubleshooting Topics

Click any question below to view an explanation and recommendations.

Operating System Version

Incorrect Version of Windows: Can Internet Scanner run under Microsoft Windows prior to 4.0 or Windows 95?

Running Internet Scanner Under Windows NT Server: Can I run Internet Scanner from a Windows NT Server?

Windows NT 4.0 Beta: I am installing under the Beta 2 version of Windows NT 4.0 and the screen flashes several times while the setup program is loading. Why is this happening?

Internet Scanner Configuration Issues

Changing Risk levels: How do I change the risk levels for individual vulnerabilities?

Missing Raw Packet Driver: What am I missing if I do not install the Raw Packet Driver?

Office 95: I installed Internet Scanner and now I cannot install Office 95. Why?

Running on a Token Ring network: If I run Internet Scanner on a Token Ring, what are the performance differences?

Running over Dial-up Networking or a modem: If I run Internet Scanner over a modem, what are the performance differences?

Too Many Users: When scanning a Windows NT server, Internet Scanner timed out with the message “Too many users.” Which setting could have caused this and why?

User is not Administrator: I attempted to run Internet Scanner as a user and my scan was not completed. Why?

Using SmartScan: What is SmartScan, and how can I control its use while scanning?

Slow Performance or System Halts

Numerical Error Codes: Internet Scanner displays a message in the form of “A critical application error has occurred. Please call ISS for more info Error 20000001, could not initiate scanner.” What does this code mean?

OOB Check: What will happen if I run the Out Of Band (OOB) check against my host?

Socket Connection Hang: When Windows NT attempts to make a socket connection, no reply occurs and the system seems to hang. What is happening here?

Solaris Inetd Loop: When I run a scan, my Solaris 2.4 machine slows down considerably. Why?

Unusually Long Scan Times: My scans are taking a long time to complete. Why?

False Positives or Inconsistent Performance

Failure to Create Null Session: I installed the LAN Manager Fix and now I cannot create a null session from a previously saved session. Why not?

Failure to ID Operating System: The results of my scans do not always correctly identify some operating systems. Why?

ICMP-based False Alarms: Why is Internet Scanner incorrectly identifying the Data Flood, System Log Flood, and Rwhod based vulnerabilities?

More than One Network Card: One of the host computers reports different information on an identical scan. What’s happening?

Only Scanning the First Domain Controller Found: Why does Internet Scanner only scan users on the first Domain Controller it finds?

Scan Results Differ w ith/ w ithout License Key: When I run a scan on an IP address of a host machine using the license key and then run a scan using the same IP address without a license key, I get different scan results? Why?

Server Operator Permissions: Internet Scanner detected that the Scheduler Key has Incorrect Permissions. The remedy is to remove write access to the Schedule Key for Server Operators. When I look at the permissions through User Manager, I do not see Server Operators listed. What is the problem?

User Password Checks Disabled: Internet Scanner disables certain password checks, even though I have enabled them. Why is this happening?

General Troubleshooting issues

Checking Status Messages in Log Files: How can I capture host status messages that show what checks were run on each host, if I am running scans non-interactively from the command line or from the Scheduler?

Safely Sending a Log File: What can I do to remove sensitive information from my log files? You will need to edit the file and remove all IP addresses and DNS names.


Using SmartScan

SmartScan analyzes vulnerabilities detected in previous scans, and builds on these vulnerabilities to discover additional vulnerabilities and security weaknesses on your network.

Internet Scanner defaults to SmartScan—no configuration is required to enable this capability. However, if you want to enable or disable the SmartScan feature, or enable the SmartScan feature in a default policy or custom policy, use one of the following methods:

  • Enabling SmartScan

  • Disabling SmartScan

  • Using SmartScan with information gathered in the current session


View Tables

The View Tables dialog box displays information on the current data source. It lets you quickly page through the various tables generated by Internet Scanner’s database. The information displayed is printed out when you generate a report on this data source in the following tables:

Jobs: Displays log information on Jobs (Sessions). The information is sorted by ID, Start Time, Stop Time, Session, and Host.

Hosts: Displays information on the hosts detected by the scan. The information is sorted by ID, Address, DNS, NetBIOS Name, and Domain.

Services: Displays log information on services detected by Internet Scanner. The information is sorted by ID, Ports, Keyword, Type, and Description. Note: Due to the large amount of information presented in this table, it may take a moment to load.

Vulnerabilities: Displays log information on vulnerabilities found by Internet Scanner. The information is sorted by ID, Vuln Name, Severity, Risk Level, and Description.

Accounts: Displays log information on users, groups, or machines detected by Internet Scanner. The information is sorted by ID, Host, Account, and Account Type.

Related Topics


What to do if a computer's security is compromised:

What to do if a computer’s security is compromised:

  1. Immediately remove the computer from the network.

  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.

  3. Perform a low-level format of all hard drives on the computer.

  4. Reinstall the operating system.

  5. Configure the computer with the original user names, groups, and applications.

  6. Run Internet Scanner to determine vulnerabilities, and resolve detected vulnerabilities.

  7. Before using the files on the backup, scan all files using an up-to-date antivirus program, and copy only the files you know to be authorized on that computer.

  8. Reconnect the computer to the network.


What's New?

What’s New?

Displays the features that are new to this release.


What's This Help

What’s This Help

Right-click your mouse to display the What’s This cursor. Click this cursor on any item in the Internet Scanner window to display more information on that item.


Zone List

Displays the available Security Zones you can choose. Each zone can have its individual set of security options.