13. Scanners¶

13.1.1. w3af scan configuration¶

Go to Configuration/Scan Configs. Create a new scan configuration and select w3af as base config:

Create a w3af scan configuration

This configuration may now be modified. The following parameters are available:

• profile You can choose between these w3af profiles. The profiles are further documented on the w3af webpage http://w3af.org. These profiles are collections of configured w3af plugins.
  • fast_scan
  • audit_high_risk
  • full_audit
  • OWASP_TOP10
  • bruteforce
  • empty_profile
  • web_infrastructure
  • full_audit_spider_man
  • sitemap
• http_request_status This allows to toggle the respective functionality.
• http_request_headers This allows to toggle the respective functionality.
• http_response_status This allows to toggle the respective functionality.
• debug_mode This allows to toggle the respective functionality.
• dry_run This allows to toggle the respective functionality.
• use_https This allows to toggle the respective functionality.
• seed_path This defines the starting URL fir the w3af scanner.
• target_port This setting allows to set another port for the webserver that the default port 80, like 8080 or 443.

13.1.2. w3af scan task¶

To scan a system you need to setup an appropriate task. Go to Scan Management and create a new task. Enter the usual information at the top of the screen: name, target, alerts, schedule, etc. Scroll down and select the OSP scanner instead of the OpenVAS Scanner:

Create a w3af scan task

Create the scan and start the scan as usual.

13.2.1. PaloAlto Scanner Configuration¶

Several steps need to be taken to use the PaloAlto Scanner.

13.2.1.1. Scan Configuration¶

To use the scanner, you need to setup a scan configuration. Go to Configuration/Scan Configs.

Create a new scan configuration and select PaloAlto as base.

Create a PaloAlto scan configuration

Here you can specify:

• dry_run This will just do a dry run.
• period For the time period the GSM will extract the logs from the PaloAlto appliance. The period should match the schedule the tasks are run at. If you run the task daily you should select last-24-hrs.
• debug_mode This will output additional debug information.
• ca-certificate This is the ca-certificate of the PaloAlto used to verify the appliance.
• address This is the ip address of the PaloAlto appliance.

13.2.1.2. Target¶

Now a specific target for the PaloAlto scan needs to be setup. Targets used in other scans may not be reused, because the login/password for accessing the PaloAlto firewall is configured using the credentials normally used for an authenticated scan.

First create the credentials for accessing the PaloAlto appliance (figure PaloAlto credentials).

PaloAlto credentials

Now create a target using these credentials (figure PaloAlto target).

PaloAlto target

13.2.1.3. Task¶

Once the scan configuration is in place you can setup a task using this scan configuration. Go to Scan Management/Tasks. Create a new task and select the OSP Scanner. Select PaloAlto and your scan configuration.

Create a PaloAlto task

Start the task. Once the task is finished you may analyze the report.

13.2.2. PaloAlto Report¶

The report generated by the PaloAlto OSP scanner is very similar to the OpenVAS report although there are some differences. The PaloAlto next generation firewall includes an intrusion detection system and not a vulnerability scanner. Therefore the vulnerabilities presented in the report are not tested by the scanner. These are detected attacks done by some third party. The quality of the results depends very much on the tuning of the PaloAlto appliance.

The following image displays a sample report:

PaloAlto sample report

The PaloAlto next generation firewall logs the possible false positive alerts using the term “attempt”. As can be seen in the sample report there are several “Generic HTTP Cross Site Scripting Attempt” and “HTTP SQL Injection Attempt”.

The PaloAlto detects the attack and in many cases stopps the attack from reaching its target. Therefore it is most often not possible to deduct whether the target actually has the vulnerability or not. This is why it makes sense to combine a regular vulnerability scan and IDS incidents within a vulnerability management solution.