CyberCop Scanner Getting Started Guide

More documents

Recommendations

Info

Getting Started: Performing a Scan About CyberCop Scanner CyberCop Scanner includes sophisticated tools for performing scans against intranets, Web servers, firewalls, and screening routers to identify security vulnerabilities in networks. CyberCop Scanner works by running modules against a target system. Modules are pieces of code that either check for vulnerabilities on the target system or attempt to exploit the vulnerabilities of the target system. Modules are grouped into module classes according to their function. For instance, some module classes gather information about the assumptions intruders might make about a computer that would allow them access to your network. Other module classes run tests against a target host to determine whether vulnerable hardware or software is present on the machine. CyberCop Scanner includes operating system detection which can identify the operating system types of hosts on a network. Once operating system types are identified, CyberCop Scanner can optionally disable modules not pertaining to specified operating systems when scanning hosts. Certain modules, called "Fix It" modules, are used in conjunction with Windows NT Registry checks. Fix It modules can be enabled to change a Registry value in order to correct potential vulnerabilities detected by CyberCop Scanner. Still other modules initiate hostile Denial of Service attacks, which look for vulnerabilities that can only be detected properly if an attack is actually launched against a target host. There are over 600 modules in the CyberCop Scanner vulnerability database. Additional modules can be added to the vulnerability database via Network Associates module updates. Or, you can add your own modules to the vulnerability database via the Vulnerability Database Editor. CyberCop Scanner uses modules in the vulnerability database when it performs a scan against a target. Modules for which a target is found vulnerable will return data. CyberCop Scanner makes use of the Network Associates Security Management Interface (SMI), a built-in application framework which provides a centralized event database for storing CyberCop Scanner security results. SMI also provides a report viewer which allows you to query the database, preview data, and generate reports. To display the version of CyberCop Scanner installed on your system, select the Help>About ScannerUI... menu item. 3-2 Chapter 3
Getting Started: Performing a Scan About the Security Management Interface (SMI) The Network Associates Security Management Interface (SMI) is the built-in application framework for NAI security applications such as CyberCop Scanner. SMI provides a single console window, called the SMI console window, with a centralized event database where CyberCop Scanner security results are stored. The SMI report viewer allows you to view data and query the event database, and to generate, preview, print, and export sophisticated graphical and text-based reports using over ten pre-defined report templates. The foundation for SMI is the Microsoft Management Console (MMC). MMC is a user interface which allows multiple programs to be accessed and run from a single console window. NOTE: Different NAI security applications use different features of SMI. CyberCop Scanner uses the centralized event database and report viewer of SMI. CyberCop Scanner does not support remote installation, remote management, event forwarding or network alerting. CyberCop Scanner Getting Started Guide 3-3
Page 1 and 2: CyberCop Scanner for Windows NT and
Page 3 and 4: Table of Contents Preface..........
Page 5 and 6: Table of Contents ScanningMultipleH
Page 7 and 8: Table of Contents Chapter 6. Runnin
Page 9 and 10: Table of Contents UnderstandinganEx
Page 11 and 12: Preface This preface includes impor
Page 13 and 14: Part II: Advanced Features Part II:
Page 15 and 16: Preface For corporate-licensed cust
Page 17: Part One: Getting Started 1
Page 20 and 21: CyberCop Scanner in Active Security
Page 28 and 29: Installing CyberCop Scanner Install
Page 30 and 31: Installing CyberCop Scanner NOTE: I
Page 32 and 33: Installing CyberCop Scanner Uninsta
Page 34 and 35: Installing CyberCop Scanner 2-8 Cha
Page 38 and 39: Getting Started: Performing a Scan
Page 76 and 77: Working With Scan Results Saving Sc
Page 78 and 79: Working With Scan Results 3. Under
Page 80 and 81: Working With Scan Results Viewing S
Page 82 and 83: Working With Scan Results Viewing R
Page 84 and 85: Working With Scan Results Using the
Page 86 and 87:
Working With Scan Results Report by
Page 88 and 89:
Working With Scan Results Querying
Page 90 and 91:
Working With Scan Results Generatin
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Working With Scan Results Fields ta
Page 98 and 99:
Working With Scan Results Previewin
Page 100 and 101:
Working With Scan Results NOTE: Whe
Page 102 and 103:
Page 104 and 105:
Working With Scan Results WheretoGo
Page 106 and 107:
Using Brute Force Password Guessing
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Running IDS (Intrusion Detection So
Page 118 and 119:
Running IDS (Intrusion Detection So
Page 120 and 121:
Using CASL Modules to Run Firewall
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
AutoUpdate: Updating CyberCop Scann
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 139 and 140:
1Using NTCASL to Generate Custom Au
Page 141 and 142:
Creating an Example Packet Using NT
Page 143 and 144:
Using NTCASL to Generate Custom Aud
Page 145 and 146:
CASL Menus Using NTCASL to Generate
Page 147 and 148:
CASL Toolbar Using NTCASL to Genera
Page 149 and 150:
Using NTCASL to Generate Custom Aud
Page 151 and 152:
2The Vulnerability Database Editor
Page 153 and 154:
About Module Records The Vulnerabil
Page 155 and 156:
The Vulnerability Database Editor L
Page 157 and 158:
The Vulnerability Database Editor M
Page 159 and 160:
The Vulnerability Database Editor E
Page 161 and 162:
Exporting Modules The Vulnerability
Page 163:
Part Three: Appendices 1
Page 166 and 167:
A Guide to CASL (Custom Audit Scrip
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Scanning: Command Line Options The
Page 200 and 201:
Scanning: Command Line Options B-4
Page 202 and 203:
Glossary Internet Internet Service
Page 204:
Glossary subnet addressing TELNET t
show all

CyberCop Scanner Getting Started Guide

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?