[lug] security scanners

[Peter Hutnick]

On Friday 05 April 2002 10:39 am, Hugh Brown wrote:
> I have been using nmap for a while and decided I should do some
> vulnerability scanning similar to what saint does.  saint is not free
> for commercial entities (and I doubt I could justify several thousand
> dollars to the PHB).  I found nessus as I was out looking for such
> things.  Does anyone have another tool that they really like (that's
> free)?

I like Nessus a lot.  It is a little weird in that it uses a "server" to do 
the actual probes and a client to control that server.

I haven't used it in about a year, but at that time it seemed to be /very/ 
well maintained and up-to-date.  The reports are thorough, readable and 
attractive to boot.

No complaints.  Two thumbs up.  Whatever.

It is also important to note that Nessus is a vulnerability scanner, where 
nmap is a port scanner.  Nessus relies on nmap to discover what ports might 
be interesting (and I think it also uses nmap's OS detection to help it find 
potential holes).  Vulnerability scanning is a whole 'nuther level beyond 
port scanning.  It really makes doing a reasonably through audit a 
non-nightmare.

-Peter