Nipper(The Network Infrastructure Parser) kullandiginiz ag cihazlarinin yapilandirma dosyalarini belirli standartlara gore inceleyerek durum raporu cikarmaya yarayan bir aractir. Mesela nipperi calistirarak “ip source routing enable” durumda olan tum routerlari ya da finger acik olan tum cihazlari belirleyebilirsiniz.
Windows/UNIX/Linux/MAC OS X gibi populer isletim sistemlerinin tumunde komut satiri araciligi ile kullanilabilir. Biraz scripting bilginiz varsa otomatik olarak tum ag cihazlarinin yapilandirmalarini guvenlik denetiminden gecirip merkezi bir yerde depolanmasini saglayabilirsiniz.
Nipper sadece buldugu eksiklikleri raporlamakla kalmiyor , bir de eksik buldugu madde ile ilgili cesitli tavsiyelerde bulunuyor.
Destekledigi bazi network urunleri.
Cisco Switches (IOS), Cisco routers (IOS), Cisco firewalls (PIX, ASA, FWSM), Cisco Catalysts (NMP, CatOS, and IOS), and Juniper NetScreen Firewalls (ScreenOS)
Nipper ile alinabilecek rapor turleri
HTML, LaTeX, XML, and text
Ornek Kullanim
C:..\Desktop\nipper-0.9.5\nipper-0.9.5>nipper –ios
–input=bbone_group-config >backbone_router_report.html
PROGRAM FEATURES / OPTIONS
==========================
Supports: Output Formats:
* Cisco IOS-based Routers * HTML (default)
* Cisco IOS-based Switches * XML
* Cisco PIX/ASA/FWSM-based Firewalls * Plain Text
* Cisco NMP-based Devices (Catalyst) * Latex (basic at the mo)
* Juniper ScreenOS-based Firewalls * Debug (development)
* John-the-ripper
Input Options:
* Stdin (default) Output Options:
* File * Stdout (default)
* SNMP / TFTP Transfer * file
Report Ouput Options: SNMP / TFTP Transfer Options:
* No Passwords * TFTP server root
* No Security Issues * SNMP community
* No Appendix * Cisco IP
* Insert Alternative Company Name * Local IP
* CSS (HTML output only) * Cisco config filename
* Document Class (Latex output only) * Old or new Cisco
* Paper (Latex output only)
* No Abbreviations
* No Common Ports
* Expand Access Control Lists
* Convert Names to IP (where possible)
Security Testing Options:
* Word List Dictionary
* Password Length
* Password Complexity
> Length (default 8 chars)
> Contain Uppers (default no)
> Contain Lowers (default no)
> Contain Upper or Lowers (default yes)
> Contain Numbers (default yes)
> Contain Specials (default no)
* Connection Timeout Testing (default 10 mins)
INFRASTRUCTURE DEVICE SUPPORT
=============================
IOS Device Configuration: NMP Device Configuration:
* Hostname * Hostname
* IOS Version * NMP Version
* Service Password Encryption * Location
* IP Source Routing * Contact
* Bootp * Core File
* Service Config * Syslog File
* Domain Lookup * Idle Session Timeout
* Enable Passwords * Port Security
* Users * Enable Password
* Privilages * Login Password
* Logon Banner * ICMP Redirects
* Finger * ICMP Unreachables
* SSH * IP Fragmentation
* HTTP * CDP
* TCP Small Services * SNMP
* UDP Small Services * Permit Lists
* NTP * VLAN
* SNMP (v1 and partial v3) * Modules and Ports
* Logging
* CDP ScreenOS Device Configuration:
* PAD * Hostname
* FTP * Admin User / Password
* TACACS * Users
* AAA * Password Length Setting
* Static Routes * Admin Privilages
* BGP * Management IP
* OSPF * Console Admin
* Key Chains (and keys) * Authentication Servers
* Lines * Authentication Timeout
* Interfaces * HTTP Redirection
* Access Control Lists * Mail Alerts
* Configuration Format
PIX Device Configuration: * SSH
* Hostname / Domain Name * Interfaces
* PIX / ASA / FWSM Version * Policies
* Transparent Firewall * Name Mappings
* Login Password
* Enable Password
* Users
* Interfaces
* NAT
* Static Routing
* Access Control Lists
* ICMP Access
* Protocol Analysis
* Group Objects
* IP Address to Name Mappings
* SSH
SECURITY AUDIT REPORT
=====================
IOS Security Issues: NMP Security Issues:
* Password Strength * Password Strength
* Dictionary Passwords * Dictionary Passwords
* Auto-Configuration * Connection Timeouts
* IP Directed Broadcasts * IP Redirects
* BGP Route Dampening * CDP
* OSPF Authentication * IP Unreachables
* Connection Timeouts
* AUX Port ScreenOS Security Issues:
* Source Routing * Policy Issues
* Finger * Connection Timeouts
* HTTP * Administrative HTTP Redirect
* IP Redirects * Management IP
* Access Control Lists
* Proxy ARP PIX Security Issues:
* CDP * Access Control Lists
* Bootp * Connection Timeouts
* TCP / UDP Small Servers * SSH Protocol Version
* IP Unreachables
* IP Mask Reply
* Enable Secret Passwords
* Password Encryption Service
* Logon Banners
* PAD
* MOP
Detayli bilgi icin: http://nipper.sourceforge.net/
