My scan target is an old Java web application deployed on JBoss v4.2.3, Windows 2012 R2.
I’m using Greenbone Community Edition v.28.0.0 to scan and found that scanning only specific port (such as TCP 8009)
displays vulnerability results like:Apache Tomcat AJP RCE Vulnerability (Ghostcat) - Active Check
However, if the Port Lists are changed to:
All IANA assigned TCP / All TCP and Nmap top 100 UDP
it doesn’t display any vulnerabilities.
I’m certain that the above range includes TCP 8009, and I’m certain that this port has a vulnerability.
How to configure the scan to ensure that a broad scan also finds vulnerabilities on specific ports?
If you are using a more extended port list it could include further open ports (like e.g. 8080) of the affected product which could cause an overload of that product during the scan.
Debugging would need to be done on the target application to make it more robust against high load situations happening e.g. during a scan, especially if it is such a legacy / outdated one.
@cfi Thanks for the reply.
Additionally, I narrowed down the port range (by executing NETSTAT -A | FINDSTR "LISTENING UDP" on the target host to get all TCP/UDP listening ports) and set the scanner option Maximum concurrently executed NVTs per host to 1, which allowed me to detect vulnerabilities.
Additionally, I changed the scanner option checks_read_timeout from 5 to 10, plugins_timeout from 320 to 640, and the timeout for some NVT Preferences from 900 to 1800. After scanning during off-peak hours, the number of error messages has significantly decreased.