![]() |
||||
|
Extending SAINTOne of the best parts of SAINT is that it is so easy to modify, configure, and add your own probes and vulnerability checks to the system. All of the probes are files that end in .saint and are kept in the bin subdirectory. The rules which SAINT uses to infer vulnerabilities are in the rules directory. (See the section on saint rules for more information on the rulesets.) SAINT tests for vulnerabilities are roughly done as follows:
Adding a SAINT ProbeIf you would like to add a probe to SAINT, such as one that will check newer versions of sendmail for bugs, you must follow the steps outlined below:
Adding a TutorialIf you decide to create your own probes, you will also probably want to create an information file to go along with it. We refer to these information files as tutorials. The tutorial should contain information such as an explanation of the vulnerability, how to fix or devise a workaround for the vulnerability, and pointers to any applicable CERT or vendor advisories. Look in the html/tutorials/vulnerabilities subdirectory for sample tutorials. To ensure that SAINT will be able to provide a link to the tutorial, look at the seventh field (canonical service output) of the record which the tool outputs. (See the saint database for more details on database records.) The filename of the tutorials should be identical to this field, with underbars ("_") instead of spaces, and an ".html" suffix. For instance, for REXD, the canonical service output is "REXD access", so the filename is REXD_access.html. Place the tutorial in the html/tutorials/vulnerabilities directory. And that's just how easy it is! After you have created your probe, be sure to place it in the ./bin subdirectory with the other SAINT probes, or have the makefile do so after processing the source code. Your probe will now be run against any target that has an attack level that corresponds to your new probe and, if necessary, which meets the conditions in the ruleset. If you would like to disseminate your new probe, or any changes to existing probes or rulesets, to the world, feel free to send it to saint@wwdsi.com, and it will be considered for inclusion in the next version of SAINT. If you are submitting changes to existing files, it may be easiest to submit the output from the diff command to show what changes were made. |