Telnet Unencrypted Cleartext Login didn't get detected

Scanning / scan configuration
1

Hi Team,

I am trying to scan a host with Telnet port enabled/open
Then, I scan using OpenVAS but the scan result doesn’t show “Telnet Unencrypted Cleartext Login” log at all.

The Scan config is, General > Enable - Telnet Unencrypted Cleartext Login
That is it!

Could you help me in this regards.

Regards,
Mithun

Use this category for all topics (General discussion of results, reporting of false positive / negative results, VT development) around vulnerability tests (the so called “NASL scripts”).

Please chose a different/better fitting category for all topics related to GVM (Installation, Usage, Configuration, Scanning).

2

Hi there and welcome,

is the scan running at all or just not detecting the open telnet port?
Should the first case apply, you need to enable a few more scripts:

Port scanners > Nmap (NASL wrapper) & Ping host
Service detection > Host Details

Cheers,
Ad

1 Like
3

Thanks for the response Ad.
Yes, the scan is running successfully, its just that the scan not detecting open Telnet port.

After multiple testing, I am able to Add “Telnet Unencrypted Cleartext Login” & “TCP/IP Predictable TCP Initial Sequence Number Vulnerability” scripts to successfully scan Telnet port.

I am wondering what is the co-relation between “Telnet Unencrypted Cleartext Login” & “TCP/IP Predictable TCP Initial Sequence Number Vulnerability” scripts to scan Telnet open port.

Can you just confirm if “TCP/IP Predictable TCP Initial Sequence Number Vulnerability” script checks any other ports or services other than Telnet service/port(23)?

Thanks again!

Regards,
Mithun

4

I can’t seem to see any relation between the two scripts.

The TCP/IP Predictable TCP Initial Sequence Number Vulnerability script checks for the values that are set in the Nmap (NASL wrapper) script. It might occur that the checks are somehow reacting to the configuration of the telnet port, but other than that they don’t belong together. Since the latter script is basing its checks on the NMAP output, I guess one could say that any open port is being checked here.

Cheers,
Ad

1 Like
5

So the reason for this is hidden in some details:

There is no relation between the Telnet Unencrypted Cleartext Login and TCP/IP Predictable TCP Initial Sequence Number Vulnerability VTs. But still the following plays a central role here:

This VT has a dependency to Nmap (NASL wrapper) which is a port scanning VT. If you add the TCP/IP Predictable TCP Initial Sequence Number Vulnerability VT to your existing scan config and Telnet ports are then found it means that your scan config doesn’t include this mandatory port scanning VT as already pointed out previously by @_ad:

6

Thanks Ad & Cfi for the detailed response. I appreciate it!

~Mithun

1 Like