security_saint

This is part of The Pile, a partial archive of some open source mailing lists and newsgroups.



Subject: Re: Insecure Browsing?
From: Gerry Doris <gdoris@home.com>
Date: Mon, 24 May 1999 20:13:01 -0400 (EDT)


Wouldn't you feel better doing it yourself???

Download and install Saint.  It will run on your browser and you can point it
at your own system.  You decide how thorough you want to probe your ip address
and away you go.

Saint will report back any security breaches (or potential ones) that it found
with a recommended fix.  It even gives the CERT advisory where appropriate.

PS.  Make sure if you are running sentry to include your own host name in the
hosts.allow file or you will be blocked immediately.  You will also have a
huge!! number to warnings in your messages file!!

Gerry



On 24-May-99 jojo wrote:
>       I would like to see something like that, as long as I know that i could
> trust the source.
>       jojo
> 
> On Mon, May 24, 1999 at 03:15:11PM -0700, Gordon Messmer wrote:
> -->Mike Johnson wrote:
> -->> 
> -->> Oh, it's quite possible.  It wouldn't take much work at all to trigger a
> -->> port scan of a system when said system accessed your website.  Further,
> -->> you could parse the browser identification and only scan Linux boxes.
> -->> You could even take it to another level.  If your scan returns possible
> -->> vulnerable services (DNS, IMAP, POP), trigger another script to attempt
> -->> an exploit.
> -->> 
> -->
> -->Wow, that's actually a really good idea.  Does anyone want to set up a
> -->web server with a great BIG disclaimer that says "Hey, we're going to
> -->scan your system for security problems, are you sure you want us to do
> -->this?" and proceed to scan the system (not attempting any cracks.)  It
> -->could return an estimated security rating (looks good from here) and
> -->maybe suggest fixes.  
> -->
> -->Could be a nice service, no?
> -->
> -->MSG

===

Subject: Re: Insecure Browsing?
From: Mike Johnson <mike.johnson@GSC.GTE.COM>
Date: Tue, 25 May 1999 12:56:17 -0400


At 08:13 PM 5/24/99 -0400, you wrote:
>Wouldn't you feel better doing it yourself???

I would, yes.  Someone out there that doesn't have a clue?  Er...

>Download and install Saint.  It will run on your browser and you can point it
>at your own system.  You decide how thorough you want to probe your ip
address
>and away you go.
>
>Saint will report back any security breaches (or potential ones) that it
found
>with a recommended fix.  It even gives the CERT advisory where appropriate.

I'm not a huge fan of Saint.  It may be because it's never picked up a
vulnerability on any of my hosts.  I dunno.  My tools of choice are:
NMAP - http://www.insecure.org/nmap/index.html
Nessus - http://www.nessus.org/

NMAP is just a port scanner.  Nessus does vulnerability testing and will
give recommendations on what it finds.

>Gerry

Mike

===


the rest of The Pile (a partial mailing list archive)

doom@kzsu.stanford.edu