Tag Archives: SikuliX

New Nessus 7 Professional and the end of cost-effective Vulnerability Management (as we knew it)

29 Replies

It’s an epic and really sad news. 🙁

Nessus 7 release

When people asked me about the cost-effective solution for Vulnerability Management I usually answered: “Nessus Professional with some additional automation through Nessus API”.

With just a couple of Nessus Professional scanning nodes it was possible to scan all the infrastructure and network perimeter (see “Vulnerability Management for Network Perimeter“). Price for each node was fixed and reasonable. And you could make your any reports from the raw scan data, as you like it.

Nessus Pro was still were best choice even when Tenable:

  • Cut off master/slave functionality in Nessus and created “Nessus Manager”.
  • Changed API completely during the update from 5 to 6 version.
  • Gradually increased the price from $1,5k to $2,7k per scanning node per year.

But unfortunately it’s not anymore. End of an era.

And what is even more sad is that Tenable does not mention disabling the API and multi-user function in the main Nessus 7 marketing, as it never was, as if it’s not very important. Just look at “Announcing Nessus Professional v7” – not a word  about “API” or users. Only in additional link:

get more information Nessus7

Only there, in the text (not a video) there is an information about removed features.

The nice little things like “Easily transferable license” and “Emailed scan reports and custom report name / logo” do not make it any better.

So, what next?

Continue reading →

Selenium, SikuliX and Social Network posting

2 Replies

The last post was about SikuliX. It’s fair to say that it’s not optimal for web applications automation. For such applications, it’s better to use something, that will natively work with your web-browse. The first solution that comes to mind is, of course, Selenium.

Selenium is a portable software-testing framework for web applications. Selenium provides a record/playback tool for authoring tests without the need to learn a test scripting language.

This app is released under the Apache 2.0 license and is a very common tool for Quality Assurance (QA). It can be also used in Information Security. For example, you can upload Selenium scripts in Qualys WAS (Web Application Scanner)  to help scanner in performing some complex operations, for example in authentication on the website.

Selenium Upload script in Qualys

Selenium is available in a form of two products: Selenium WebDriver for some hardcore automation and web-browser plugin Selenium IDE, which will help you to create and run scripts. I chose Selenium IDE.

Selenium types
Continue reading →

SikuliX: the last chance for automation

3 Replies

This post I will publish in the API section of my blog. However, it is about the situation when there application has no API. Let’s suppose that we have to use in our work some graphical application or web-service. And unfortunately we need constantly repeat some very routine and annoying operations in it. This often happens if the application developers have not thought enough about the real-life cases their end-users will deal with. What can we do in such scenario?

  • First of all, look maybe there is an open and documented API
  • If there is no API, and it is an installed application, maybe you can use it in a console mode
  • If it is a web-service, maybe you can figure out how it works and how to automate it using tools like Firebug

But sometimes it is impossible to do anything at all. And it is even more sad, if this routine task is really elementary and you can easily explain the logic: what menu to choose, what button to push, where you should enter text and so on.

At this point, you just spit on all and use your last resort – SikuliX.

SikuliX Script window

With this tool, you can automate everything. It doesn’t matter if it is a web-service or a GUI application, what operating system it uses and so on. That’s all because SikuliX is working at the highest level. In fact, it just makes screenshots, analyses them as images, trying to find graphical elements that it should somehow use.

Continue reading →