Nessus History file (date format : day/month/year)

  xx.11.1998 :
 
 * Bob Tinsley <bob@earthrise.demon.co.uk>
 
   [nessus/*] : global variables now defined in globals.h, and start with a
   capital
   - this makes it clearer from the object files which are global variables
     (so that they don't all export rubbish and clutter the name-space)
   - this also solves some of the compiler problems where locals shadow
     globals
   - TODO: globals.c
   - TODO: the same for the other directories

   [nessus.tmpl.in] : adds lots of -Wxxx options to gcc
   (note that this should be moved down that file a bit)

   lots of fixes to reduce errors from the above

   lots of prototypes now use "const char *" rather than "char *"
   (note that this work is still ongoing)

   GNU C's __attribute__ ((format)) is used where appropriate for
   type-checking

   estrdup() has been added, and is used in a number of places

   header files have been "improved" so that
    - they (all?) contain your copyright notice
    - the #ifdef's used to ensure that each file is only included once
      have been sanitised so that they are all consistent...
          #ifdef _NESSUS[CDL$]_FILENAME_H
      for the client, daemon, library, and include directories
      (note that we could just use _NESSUS_FILENAME_H as filenames are
      reused)

    pixmaps are declared static

    a couple of bits in the plugins are declared static

    more minor fixes
  
  * Renaud Deraison <deraison@nessus.org> :
  
   [nessuslib/ftp_funcs] : defined some ftp functions here,
   so that writing ftp plugins is easier
   
   [nessuslib, nessusd/] : the plugins can now communicate
   with each other, so they can share their results or 
   use them. This makes the tests faster and more accurate
   
   [plugins/] : more plugins
   
   
  16.10.1998 :
  
  * Paco Brufal <pbrufal@ctv.es> :
  
   [nessus/report.c] : the two buttons of the report window
   are no longer sticked together
   
  * Nils Lohner <lohner@icd.teradyne.com> :
  
   [src/] : modified some stuff so that Nessus now compiles
   under Solaris
   
  * Javi Polo <javipolo@infomail.lacaixa.es> :
  
   [nessus/report.c] : the window now has a close button
   
   [nessus/prefs_dialog/] : created the 'open report...' button
   
   [nessus/] : the report are now saved in /usr/local/share/nessus
   
  * Renaud Deraison <deraison@worldnet.fr> :
  
   [nessus/monitor_dialog.c] : now shows in realtime which plugin
   is being launched against the remote host
   
   [nessus/report.c] : the default name of the report file
   is the name of the primary target
   
   [src/plugins/] : corrected several incorrects reports in several plugins
   
   [src/hostloop/] : a new option now allow the nessus to only test the
   hosts the ip of which can be reversely looked up. (Suggested by Noam
   Rathaus [dolittle@israelmail.com]).
   
   [src/nessusd/nmap.c] : the port scanner is now an external plugin
   
   [src/] : better firewall support
 
   [src/plugins/default_accounts]
   [src/plugins/proxy_check] : corrected a problem which would make 
   false warnings
   
   [src/hostloop/icmp] : corrected a problem which would prevent icmp
   tests from working correctly under Linux
   
   [nessusd/nessusd.c] : the server socket has now the option SO_REUSEADDR
   which corrects a problem encountered by many people who wanted to
   kill nessusd and to immediately relaunch it.
   (suggested by Tracy R Reed <treed@ultraviolet.org>)
   
   [configure] : the script is now able to determine if the host
   we are compiling on is using the BSD byte ordering...
   
   many new plugins
   
  14.09.1998 :
  
  * Sebastian Schreiber <Sebastian.Schreiber@student.uni-tuebingen.de> :
     
     added the plugin 'x11'.
    
  * Gordon Matzigkeit <gord@trick.fig.org> :
  
     [Makefile] : modified the toplevel Makefile so that you can now
     just type 'make client' or 'make server'
     
     [ltconfig] : the plugins can now be linked to external libraries
     
  * Javi Polo <javipolo@infomail.lacaixa.es> :
  
     [nessus/error_dialog.c] : the dialog window now appears on
     the center of the screen
     
     added the plugin 'sendmail_helo'
     
     [doc/nessus.1] : created the man page
     
  * Renaud Deraison <deraison@worldnet.fr> :
   
     [doc/Manual] : created a light manual explaining how to use
     Nessus for the first time
        
     [nessus/nessus.c] : more reliable command line interface, but
     not safer (the password is dislayed in clear text whenever
     someone do a 'ps -auxw').
     
     [nessusd/attack.c] : corrected a bug which would make 
     NessusNT (and the pthreads version of NessusUnix) mix
     the reports between the hosts
     
     [nessusd/threads.c] : experimental pthread support.
     you must do a 'configure --enable-pthreads' to use it.
     
     [include/includes.h] : created and used instead of all
     the other includes everywhere in the code. Thanks to
     Gerard Le Comte <lecomte@sns.fr> for having suggested 
     this
     
     [Makefile] : Nessus now installs properly when a 'make install'
     is made
     
     [nessus.tmpl] : created. This file contains all the definitions
     that are used in the other Makefiles. Thanks to Gerard Le Comte
     <lecomte@sns.fr> for having suggested this
     
     [nessus/preferences.c] : the file ~/.nessusrc is more readable
     by humans.
     
     [doc/ntp_white_paper_11] : updated
      
     [Makefiles] : cleaner Makefiles. The plugins are now build
     only when needed.
     
     [nessus/preferences.c] : corrected a problem in the plugins
     preferences (the new plugins would not be taken in account)
     
     [nessus/report_file.c] : corrected a bug which would prevent
     the user from reading back a saved file
     
     [nessus/report.c] : new reporting interface
     
     [nessusd/log.c] : more detailed logs
     
     [nessusd/rules.c] : now works with the names and the IPs
     
     [nessusd/] : the code is now reentrant
     
     [nessusd/] : corrected minor problems which had to do with
     NTP/1.0 backward compatibility (and prevented third parties
     client to work properly)
     
     [nessusd/] : reduced the memory consumption (the plugins are now
     loaded only when needed, several pointers are now freed)
     
     [nessusd/] : the server does not use any async socket any more
     
     [nessusd/] : the server uses less signal handlers, which tends to
     make the code cleaner.
     
     [nessusd/] : fnmatch() is now part of the source code (necessary for
     NT source compatibility)
     
     [nessusd/] : corrected a bug in the threads manager
     
     [nessus/] : corrected a bug in the client which was occuring
     when the 'stop whole test' button was clicked
     
     [hostloop/] : the code is now reentrant
   
     [nessusd/utils.c] : corrected a bug in the 'send_plugins_order'
     section
     
     [nessusd/]   :
     [nessuslib/] :
     [hostloop/]  : compile as well under NT as under Unix
     
     [configure] : now correctly detects whether it's necessary to 
     redefine the structs ip and icmp
     
     [plugins/pop3_overflow] : now checks for multiple overflows
     
     [include/config.h] : the default port is now 3001 instead of 3000
     
     added the plugins 'faxsurvey', 'thttpd', 'guess_os', 'ftp_misc_overflows',
     'proxy_check', 'iChat'.
    
    
  01.08.1998 :
  
  * Renaud Deraison <deraison@worldnet.fr> :

     [nessuslib/plugutils.c] : new function (add_preference())
    
     [nessuslib/resolve.c] : correction of a bug in the DNS cache
     
     [nessus/] : brand new interface which takes advantage of the
     new NTP/1.1 protocol.
	
     [nessus/] : now opens the file which is given in argument.
	
     [nessus/prefs_dialog/*] : created. It's now possible to
     configure the server remotely with a nice interface.
     
     [nessus/] : now compatible with NTP/1.1. NOT backward
     compatible with NTP/1.0
     
     [nessusd/] : changed the communication protocol to 
     version 1.1. (it's backward compatible with 1.0 
     though)
     
     [hostloop/] : added the 'guess by IP' technique
     (scans a whole class A,B or C subnet).
     
     [hostloop/] : added the NFS relationship
     
     [hostloop/icmp.h] : the target can now be pinged before
     being attacked -- this means that the server MUST be
     suid root.
     
     [nessusd/] : cleaned up the code, and started to comment
     everything. Also, the memory management is getting
     clean and cleaner.
     
     [nessusd/nessusd.c] : removed a lot of useless global
     variables
     
     [nessusd/threads.c] : better thread management. Faster
     and more reliable.
     
     [plugins/] : corrected some minor problems that used to
     appear in some plugins.
     
     [src/] : improved Solaris support
     
     added the plugins  'annex_dos', 'ftp_cwd_root','default_accounts',
     'dumpenv', 'uw_imapd',  'WebSite' and 'wingate2'.
     
    
  05.07.1998 :
  
  * Renaud Deraison <deraison@worldnet.fr> :
   
     [plugins/pop3_overflow] : corrected a little bug which would
     prevent the plugin from actually working
    
     [plugins/ssh_insertion]: 
     [plugins/qpopper_overflow] :
     [plugins/motorola_cable_modem] : added.
     
     [nessus/plugin_list.c] : corrected (the last ?) bug
     in the plugin selection.
     
     [nessuslib/arglist.c] : corrected a possible bug in
     arg_get_value()
     
     [nessuslib/plugutils.c] : corrected a potential problem
     with host_get_port_state()
     
     
  27.06.1998 :
  
  * Renaud Deraison <deraison@worldnet.fr> :
  
     [hostloop/] : several networks can be tested at the same
     time : you just have to enter the name of the networks
     separated by a ','. ie : 'grincheux.nain.org,arf.joe.com'
     You can also use this feature to test a restricted set
     of hosts : 'grincheux,prof,atchoum' will only test three
     hosts.
     
     [nessusd/attack.c] : corrected a bug which would make
     nessusd attack the same network during an entire session.
     
     [plugins/ftp_root] 
     [plugins/ftp_site_exec] 
     [plugins/mspws]
     [plugins/mdaemon]      : corrected bugs
     
     [nessusd/comm.c] : corrected a problem which would make the
     server eat all the memory when the connection is closed improperly
     by the client.
     
     [nessuslib/] : corrected some minor problems
     
     [nessusd/] : corrected a little problem which had to
     do with async sockets
     
     [plugins/land] :
     [plugins/ascend_kill] :
     [plugins/sping] : ported to BSD
     
     [plugins/bonk]:
    
     [plugins/chameleon_smtpd_overflow]:
     [plugins/ews]:
     [plugins/frontpage] :
     [plugins/ftp_user_overflow]:
     [plugins/winnt_dns_qr] :
     [plugins/winnt_dns_flood]:
     [plugins/wins_udp_flood]:
     [plugins/iis_crash] : added
     
  14.06.1998 :
  
  * Krzysztof G. Baranowski <kgb@manjak.knm.org.pl> :
  
     [src/] : removed warnings
  
  * Renaud Deraison <deraison@worldnet.fr> :
  
     [nessusd/] : modified the communication
     management so that the socket of the program is not stdin
     and stdout anymore.
     
     [nessusd/sighand.c] : modified the way nessusd was reading
     its non-blocking socket (was buggy under FreeBSD).
     
     [nessus/plugin_list.c] : corrected a bug in the plugin 
     selection
     
     [nessuslib/] : cleaned up and improved
     
     [nessuslib/] : post_* now parses the char 13 (aka cr)
     
     [nessus/attack_dialog.c] : now checks that the user has actually
     entered a hostname to attack.
     
     [nessus/nessus.c] : new option : '-n' which means 'No pixmaps'.
     
     [plugins/cfinger_search] : corrected a bug which would make this
     plugin display a bad result.
     
     [plugins/] : modified to be more compatible between NT and Unix
     (at source level) ; corrected some bugs that were running around.
     
  20.05.1998 :
   
  * Nils Lohner <lohner@icd.teradyne.com> :
   
    corrected the scripts and some includes so that Nessus should compile
    more easily under Solaris.
     
  * Renaud Deraison <deraison@worldnet.fr> :
  
    [nessusd/pluginload.c] : corrected a bug that was occuring under
    NetBSD while loading the plugins.
    
    [nessus/plugin_list.c] : the client now remembers correctly the
    plugin set chosen by the user (there was a bug).
    
    [nessuslib/plugutils.c] : corrected a bug which would make the
    plugin family selection quite unusable
    
    [plugins/] : added about ten new plugins, corrected some bugs
    in some other plugins.
    
  12.05.1998 :
  
  * Mullen, Patrick <Patrick.Mullen@GSC.GTE.Com> :
  
    [nessusd/attack.c] : replaced 'getuid()' by 'geteuid()'
    
  * Renaud Deraison <deraison@worldnet.fr> :
 
    [nessusd/] : the daemon and its libraries, as well as most of
    the plugins, compile properly under Solaris.
    
    [hostloop/] : corrected a bug which would cause a segmentation
    fault under some circumstances
    
    [nessus/pref*] : added preferences support to the nessus client
    
    [nessusd/] : corrected a nasty bug which would make the 
    test process sometimes hang...
    
    [nessusd/] : nessusd now correctly waits for its children
    to die (no more zombies hanging around)
    
    [nessus/] : the client now checks that the user enters
    everything he must enter.

    [nessus/] : corrected SIGSEGV that were occuring when some
    windows were closed using the window manager.
    
    [nessus/comm.c] : corrected a bug which would make the client
    eats all the memory when the communication was improperly closed
    by the server.
    
    [nessusd/nessusd.c] : nessusd now correctly handles SIGINT
    when compiled with AF_UNIX support.
    
    [nessusd/attack.c] : corrected a bug that would make 
    the client status bar unreliable during the attack.
    
    [nessus/parser.c] : corrected a problem which would make the 
    client (and the server) hang after the last attack, until
    'stop' button was pressed...
    
    [plugins/ftp_real_path] : corrected a bug which would make the plugin
    make an irrelevant report when launched against some FTP servers
    with very long banners. 
    
    [nessusd/user.c]
    [nessusd/rules.c] : corrected problems and added functionalities
    to the nessusd rules. 'N' now bypasses 'y' (which bypasses 'n').
	
  20.04.1998 :
  
  * Scott Smyth <sbsmyth@mindspring.com> :
    
    adapted libtool to Nessus
    
  * Peter Bruderer <brudy@hallo.ch> :
  
    added nph-test-cgi
  
  * Gordon Matzigkeit <gord@m-tech.ab.ca> :
  
    [nessus/nessus.c] : connect_to_nessusd() now returns an error
    in plain text rather than an error code
    
    [nessus/auth_dialog.c] : slightly modified the dialog box (which
    is now smarter)
    
  * Renaud Deraison <deraison@worldnet.fr> :
   
    [nessus/nessus.c] : the client can now be command-line driven
    (but this feature is somewhat experimental...)
    
    [nessusd/nmap.c] : now using nmap 1.49
    
    [nessusd/] : added multi-users support, with permissions for
    each users. See doc/sample.usersdb for the user database
    exact syntax (which is a bit tricky -- I will improve that 
    later on)
    
    [nessuslib/plugutils.c] : corrected some stuff so that a badly
    written plugin can't crash the server by accident...
    (however, a malicious plugin can do everything it wants)
    Thanks to Jan Roudaut <hotcode@poboxes.com> for his reports and
    comments.
        
    [nessusd/] :
    [nessus/]  : it's now possible to specify the max number of hosts
    		 to test.  
    		 
    [nessusd/nessusd.c] :
    [nessus/nessus.c]   : support for AF_UNIX sockets (more secure than 
    AF_INET, but the server and the client have to be on the same host)
    (the choice of the socket type is made in config.h)
    
    [nessus/] : improved the interface
    
    [nessusd/comm.c] : correction of a bug which would make the daemon
    accept any username and password (and I dare to call this a *security
    auditing tool* !) -- this was a sequel from early pre-alpha development
    
    [nessus/error_dialog.c] : created
    
    [nessusd/comm.c] : the plugins description may now contain '\n'.
    
    [nessus/report.c] : the list of holes is now shown in
    a text widget, so that the words wraps correctly.
    
    [plugins/] : the descriptions of the plugins are more detailled.
    
    [plugins/ircd_dos/] : corrected a problem which would make the attack
    process stall during 8 seconds even when there was no irc server...
    
    cleaned up a lot of stuff in the code, but some things are still messy...
    
  10.04.1998 :
  
  * Krzysztof G. Baranowski <kgb@manjak.knm.org.pl> :
    
    [plugins/statd/statd.c] : corrected a bug
    
    [plugins/cgi_count] : added
    
    [src/] : clean up (removed *.orig files)
    
  * Renaud Deraison <deraison@worldnet.fr> :
   
    [nessuslib/plugutils.c] : corrected a minor problem
    
    [plugins/bind_bof] : added.
    
    [nessus/plugin_list.c] : the plugins are now sorted by
    families.
    Corrected a bug which would prevent a plugin to be actually
    deactivated.
    
    [nessus/report.c] : corrected a problem which would
    make the client crash while displaying a report, if
    a host was not selected.
    
    [nessusd/preferences.c] : corrected a problem which would
    cause the daemon to crash if it could not read nor create
    its preferences file
    
    a new preference flag has been set : 'test_file' which is the 
    remote file that the attacks will try to read -- thanks to
    Sergio Ballestrero <sergio@pratonext.it> for suggesting
    this.
    
    [nessus/Makefile.in] : now uses 'gtk-config', provided with gtk+-0.99.9
    
    [plugins/glimpse/glimpse.c] : corrected a typo
  
    [nessus/main_window.c] : the pixmap now shows later on, avoiding
    a stupid warning from gtk
    
    [plugins/land/land.c] : adapted the includes to MkLinux 
    
    [doc/plugins_api] : updated (more accurate)
    
    [nessus/plugin_infos.c] : the plugins now show their copyright
    and description when they are being clicked.
    
    [nessus/report.c] : corrected a bug that would make nessus
    sigsegv when the report window was closed
    
  5.04.1998 :
  
  * Renaud Deraison <deraison@worldnet.fr> :
    [nessusd/preferences.c] : corrected a problem about the 'nessusd.rules'
    file which was not created at the right place
    
    [nessus/plugin_list.c] : adapted the plugin list to gtk-0.99.9
    [nessus/auth_dialog.c] : the password field is no longer echoed 
    to the screen
    
  * Andrew Snare <ajs@pigpond.com> :
    [configure.in] : corrected a problem with configure which would not 
    recognize the 'libresolv' under Red Hat 5.0 (glibc)
    
  * Krzysztof G. Baranowski <kgb@manjak.knm.org.pl> :
    [plugins] : corrected minor problems that were occuring while compiling 
    Nessus under the Red Hat 5.0 (glibc)
  
  4.04.1998 :
  
  * first public alpha 
  
--------------- DEVELOPMENT INFOS

  * corrected a bug in the daemon that would make it
    eat all the available memory when the connection 
    was closed improperly.
    
  1.04.1998 :
  
  * the 'reports' window can now be resized
  
 30.03.1998 :
 
  * the 'stop' button works
  
  * added plug_set_family() and plug_get_family() in the nessuslib
  
  * corrected a bug in the thread manager which would force nessusd
    to not test some hosts
    
 29.03.1998 :
 
  * added some plugins
  
  * corrected a major bug in the client that would make it
    segv when the user clicks on a 'warning' in the report window
    
 28.03.1998 :
  
  * the client can now save and read back the reports of the attacks
  
  * corrected a minor bug the in the report window of the client
  
 27.03.1998 :
 
  * added a progress bar showing the state for each host tested
    (it really looks nice -- doesn't it ? :)
  
  * added some denial of services attacks against WindowsNT/95
    machines
  
  * corrected a little bug on the server which was
    misinforming the client about the plugin type
    
 26.03.1998 : 
 
  * corrected a minor bug that was occuring while the client was
    getting all the plugins informations
    
  * improved the plugin list of the client -- the user can now
    disable the plugins he doesn't want to use
    
  * tooltips for the plugin list
  
 25.03.1998 :
 
  * the 'plugin list' button of the client now works
  
  * corrected some minor problems in the makefile of
    the client
    
  * removed some obsolete includes in the client
  
  * wrote a better plugin api white paper
  
 22.03.1998 :
 
  * finished to rewrite the client using gtk
  
 21.03.1998 :
 
  * implemented quickly the rules support for the
     daemon
     
  * Client partially rewritten using gtk
  
 20.03.1998 : 

  * The server now sends the plugin description and the plugin
    summary to the client
    
  * The plugins are now launched according to this order :
    ACT_GATHER_INFO, then ACT_ATTACK, then ACT_DENIAL
    
  * The hostloop doesn't try to get the domain name
    of numeric IP any more...
    
 19.03.1998 : 
 
  * Nessus can be configured a little more in include/config.h
  
  * added a timeout for the plugins (if a plugin takes more than
    PLUGIN_TIMEOUT secs to finish, it's killed)
  
  * corrected a bug in the nessuslib, in function arg_get_value()
  
  * improved the plugins output
 
  * added 'post_info()' (to use instead of post_hole() when
    a little vulnerability has been discovered)
    
    
 18.03.1998 : 
 
  * plugins are now launched after a fork() (so if a plugin
    segv, the whole attack won't be canceled)
    
  * corrected some bugs in the nessuslib
 
  * added a basic reporting interface to the client
  
  * the client is based upon XForms, but this will change
    very soon... 
    
  * the server can now log important events
 
  * the server now handles command line options
  
  * sanitized the code
  
  * nessusd nearly compiles under SunOS (there are glitches at link
    time, but that's not a big deal)
    
  * 'configure' works under SunOS 4.x
  
 17.03.1998 : 
 
  * improved the Makefiles (replaced @PWD@ by @top_srcdir@)
   
  * The hostloop library now compiles under SunOS 4.x
    
  * improved the NTP for reporting
  
 16.03.1998 : 
 
  * improved the client parser
   
  * modified the Nessus Transfert Protocol
  
 15.03.1998 : 
 
  * started to write a client
  
  * cleaned up the headers files. Every critic file is now
    in include/
    
  * nessusd is now also linked to the nessuslib (this
    suppress some functions that were redundants...)
    
  * added 'is_cgi_present()' to the nessuslib
    
  * Integrated the 'resolve' function of the nnet lib to
    the nessuslib
    
  * The 'nnet' library has been removed from the source
    tree
    
 13.03.1998 : 
 
  * improved 'nessuslib'
  
  * creation of the first functional plugins
  
 19.02.1998 : 

  * ported the HostLoop system as a library used by nessusd
  
  * corrected a major bug in the caching system of the 
    nnet library
    
 16.02.1998 : 
 
  * included a part of Fyodor's 'Nmap'
  
 15.02.1998 : 
 
  * corrected the caching system of the nnet-lib
  
  * included 'nessusd' to the source tree.
  
  * included the 'libnessus' to the source tree (used by plugins)

 06.02.1998 : 

  * nnet-lib [create_socket.c] : removed warnings (mainly casts).

  * Cleaned up source tree.

 05.02.1998 : 

  * configure : modified in order to check the presence of ar(1) and
  ranlib(1), needed by libraries such as nnet-lib.

  * GNU Standards included in doc/ directory in PostScript format.

  * Coding style rules (in french) in doc/CodingStyle.

 04.02.1998 : 

  * nnet-lib : basic nn_resolve() function implemented. Cache doesn't work
  as expected, so it is currently disabled. You can compile the file with
  -D_NN_RESOLVE_CACHE to get it compiled.

 29.01.1998 : 

  * First implementation of a little daemon. Used only for test-purposes,
  and not included to the standard distribution. 

  * Some documentation, in french.

 27.01.1998 :

  * configure : short discover of autoconf... Current configure and Makefile
  framework seems to be fine enough to consider starting the project soon ;)



