Web proxy
scanner is a tool to check vulnerabilities of web servers( this scanner can
work as a port scanner if Check CGI Vulnerabilities is not enabled).
It is evident
that CGI probes are sent against web servers. This tool provides an ability to
configure the scanner for running CGI probes through that proxy ( if Enable
Proxy is turned on ) or without proxy (if Enable Proxy is turned
off ) .
Here is a brief description of
each field located in Host Scan Settings. The field Command contains
the command type ( GET, PUT,POST, etc.), the field Scheme contains the
protocol type (http, ftp, gopher ), the field Host contains the host
name ( ex. Camelot,
www.nsauditor.com ), the field URL contains
the URL, the field User Agent contains the name of the client program
( Nsauditor/1.0, Mozilla/5.0, Mozilla/4.0 ) , the field Timeout contains
the timeout interval to wait for responses, the field Ports contains port
numbers( you can select port numbers by clicking on the browse button).
Turning on Check CGI
Vulnerabilities allows you to select the service( Common, Apache, etc .) for
checking vulnerabilities. Note that if the selected service is Front Page or
IIS than the operating system of destination host should be Windows. You can
use
Ping
to check the operating system.
To connect through proxy turn on
the Enable Proxy setting and select one of anonymous proxy servers from
the list.
The probe that will be sent to the
target host is based on the mentioned parameters. There are some known
vulnerability tests for each service.
You can configure these tests
using Options/Configuration ( CGI Abuses ) .
Double clicking on the scan entry you can view the CGI Abuse
details. The dialog below shows all the details of the selected row .
Selecting the appropriate CGI
from the CGI Groups allows you to see all the check probes for the selected
CGI including CGI Name and CGI Description. Selecting one of the CGI checks will
show the CGI Abuse Details for that check including Risk Level, Abuse Name,
Method, Directories, RCode ( return code ), Directories, Check URL, BagtraqID,
Comment.
These well known tests are used
to create the probes. You can hide the name of your real user agent by
selecting any other from the list( it will seem that the probe is sent not
from the real sender Nsauditor ).
You can add, delete and save the
information in the page by clicking on the Add, Delete, Save buttons
accordingly.
If View All Responses is
turned on the Responses List of Network Security Auditor window will
contain all responses. Otherwise the list will contain only the responses with
open ports. You can double click on the row to view http header, source and
data of each response ( left, middle , right parts of bottom section ).
