First we need to connect to the nessus server:

And create a new scan-session:

Enter the IP-number or server name of your OCS installation:

Nessus includes some port-scan methodes, you should enable at least nmap.

To have some fun, I just enabled all plugins. If you like you can disable scans you do not like (e.g. scans for Mircosoft Windows or IIS).

Some plugins can be configured with some additional parameters, to get some more indepth information I entered usernames/passwords for POP3 and IMAP. I also enabled anonymous FTP logins in IFS.

It is time to execute your scan now:

You make take a cup of coffee and watch the progress bar :-D

Thats the funny part, reading and analysing the scan results

Currently there are only a few nessus plugins that perform tests on Oracle products. That is may be related to the fact that not many nessus hackers have running Oracle installations. But that also means that we have to write our own plugins.

Anyway, writing plugins for nessus is most of the time very simple business (depending most of the time on the underlying protocols used). My example will test if one of the Oracle Demos is accessible. This demo may allow SQL injection so it is worse checking for it.

Nessus plugins are normally structured in two parts:

To start with writing a new plugin I am normally searching for similar plugins that already exist. So you just have to copy the existing one and use it as an template for the new one :-).

So lets start with coding, we want to check if we can request an URL to /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW. And that is the NASL code for this one:

if(description) {
  script_id(11918);
  script_version("$Revision$");
  name["english"] = "Oracle 9iAS PORTAL_DEMO ORG_CHART";
  script_name(english:name["english"]);
  desc["english"] = "your description of the plugin";
  script_description(english:desc["english"]);
  summary["english"] = "Tests for presence of Oracle9iAS PORTAL_DEMO.ORG_CHART";
  script_summary(english:summary["english"]);
  script_category(ACT_GATHER_INFO);
  family["english"] = "CGI abuses";
  script_family(english:family["english"]);
  script_dependencie("find_service.nes", "http_version.nasl");
  script_require_ports("Services/www", 80, 7777, 7778, 7779);
  script_require_keys("www/OracleApache");
  exit(0);
}

include("http_func.inc");

port = get_kb_item("Services/www");
if(!port)port = 80;
if(get_port_state(port)) {
  req = http_get(item:"/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW", port:port);
  soc = http_open_socket(port);
  if(soc) {
    send(socket:soc, data:req);
    r = http_recv(socket:soc);
    http_close_socket(soc);
    if("Organization Chart" >< r)
      security_hole(port);
  }
}

I marked the really important parts of the code in red, even if you don't know C or other programming languages very well, it shouldn't be very difficult to read the code. We send our URL and check if the response includes the string "Organization Chart" which is the title of that demo page. That's all folks :-). If you want to learn more about NASL, just visit the Nessus Homepage and read the NASL reference.

For your reference you can also download the plugin from my homepage. Normally you should get the latest version during a normal nessus plugin update.