full-disclosure - Vulnerability Scans

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200312022028.hB2KSL710854@netsys.com>
From: rraver at ipconsole.com (Robert Raver)
Subject: Vulnerability Scans

Hey,

I am doing a report on vulnerability scans and what should be included in
it.  I came up with a list of what I think should be included in a scan for
in different operating systems.  Wondering if you guys could direct me to
pages that can inform me or give me your ideas.  Below is the lists I
created.  This is for a scan on a single machine and is mostly targeted
towards Unix/Linux machines.  Let me know.

            This section lists the Unix system security criteria:

1.      /etc/passwd not world-writable

2.      No unnecessary services running

3.      FTP directory not writable by user anonymous

4.      NFS not configured to be world-writable

5.      Passwords not crackable by dictionary attack

6.      .

7.      .

1.1.1   Windows System Security Criteria

            This section lists the Windows system security criteria:

1.      guest account disabled

2.      No unnecessary services running

3.      System patched with most recent applicable hot fixes

4.      Passwords not crackable by dictionary attack

I have also included a port/services scan using nessus and the SANS Top 20
list.

Thanks,

Robert Raver

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031202/25bf5914/attachment.html