Possibility to add an identifier to the vuln tests?

AlexK · April 11, 2024, 9:08am

Hello,

For Greenbone community edition, is it possible to attach some sort of token/identifier to the requests when launching scans during the vulnerability tests so that our operators could add this identifier to a whitelist in order to not create alerts on their end?

It’s in a case where they can’t check the IP of the requests.

Lukas · April 11, 2024, 10:43am

Hi,

It is better to create a alert and inform the NOC / SOC that a scan is started. Due to the fact that is not possible with many PDUs to include such a identifier.

AlexK · April 11, 2024, 10:48am

I see, thanks for reply.

cfi · April 11, 2024, 10:59am

Note that at least for many HTTP based tests the scanner is already adding / using a UserAgent identifier like e.g. the following:

UserAgent: Mozilla/5.0 [en] (X11, U; OpenVAS-VT 9.0.3)

github.com

greenbone/openvas-scanner/blob/527040c6fdd4fdab65643ddde4ddeff17f4196e0/misc/user_agent.c#L48-L75


      
          /**
           * @brief Create and set the global User-Agent variable.
           *
           * @description Gets the User-Agent from the globals_settings.nasl
           * script preferences. If it is not set, it uses the Vendor version.
           * In case that there is no Vendor version, it creates one with a fix string
           * and the nasl library version.
           */
          static void
          user_agent_create (void)
          {
            gchar *ua = NULL;
          
            ua = get_plugin_preference ("1.3.6.1.4.1.25623.1.0.12288", "HTTP User-Agent",
                                        -1);
            if (!ua || strlen (g_strstrip (ua)) == 0)
              {
                g_free (ua);
                if (!vendor_version_get () || *vendor_version_get () == '\0')
                  ua = g_strdup_printf ("Mozilla/5.0 [en] (X11, U; OpenVAS-VT %s)",

This file has been truncated. show original

AlexK · April 12, 2024, 6:50am

Yes I noticed indeed, tho idk if its for all requests

rippledj · April 14, 2024, 10:25pm

As cfi mentioned, this is added to HTTP requests. Not all protocols use headers the same way as HTTP. For example, SSH (Secure Shell) does not support the use of custom headers.

cfi · April 15, 2024, 1:18pm

In addition to this there are also various HTTP VTs which are e.g. not sending a User-Agent on purpose (because e.g. it is required for an exploit to overwrite it).

But the operators probably could already use the existing user agent to identify the IP / origin of the scanner to identify the whole scan traffic accordingly.