For other uses of the word "Saint", please refer to Saint (disambiguation)

Saint (disambiguation)

Saint is the designation of a holy person.Saint may also refer to:-Places:*Saints, Luton, England*Saints, Seine-et-Marne, France*Saints, Yonne, France*Îles des Saintes, France-Sports teams:*Lady Saints, American women's volleyball team...

.

SAINT (System Administrator’s Integrated Network Tool) is computer software used for scanning computer networks for security vulnerabilities

Vulnerability (computing)

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw...

, and exploiting found vulnerabilities.

SAINT Network Vulnerability Scanner

The SAINT scanner screens every live system on a network for TCP

Transmission Control Protocol

The Transmission Control Protocol is one of the core protocols of the Internet Protocol Suite. TCP is one of the two original components of the suite, complementing the Internet Protocol , and therefore the entire suite is commonly referred to as TCP/IP...

 and UDP

User Datagram Protocol

The User Datagram Protocol is one of the core members of the Internet Protocol Suite, the set of network protocols used for the Internet. With UDP, computer applications can send messages, in this case referred to as datagrams, to other hosts on an Internet Protocol network without requiring...

 services. For each service it finds running, it launches a set of probes designed to detect anything that could allow an attacker to gain unauthorized access, create a denial-of-service

Denial-of-service attack

A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...

, or gain sensitive information about the network.

SAINT provides support to The Security Content Automation Protocol (SCAP) specification as an Unauthenticated Vulnerability Scanner and Authenticated Vulnerability and Patch Scanner. SAINT is also an approved scanning vendor with the Payment Card Industry (PCI).

The Four Steps of a SAINT Scan:

• Step 1 – SAINT screens every live system on a network for TCP and UDP services.
• Step 2 – For each service it finds running, it launches a set of probes designed to detect anything that could allow an attacker to gain unauthorized access, create a denial-of-service, or gain sensitive information about the network.
• Step 3 – The scanner checks for vulnerabilities.
• Step 4 – When vulnerabilities are detected, the results are categorized in several ways, allowing customers to target the data they find most useful.

SAINT can group vulnerabilities according to severity, type, or count. It can also provide information about a particular host or group of hosts. SAINT describes each of the vulnerabilities it locates; references Common Vulnerabilities & Exposures (CVE), CERT advisories, and IAVA (Information Assurance Vulnerability Alerts); and describes ways to correct the vulnerabilities. In many cases, the SAINT scanner provides links to patches or new software versions that will eliminate the detected vulnerabilities.

A vulnerability is a flaw in a system, device, or application that, if leveraged by an attacker, could impact the security of the system. Exploits take advantage of a vulnerability by compromising or destructing the vulnerable system, device, or application. Remediation is the process of repairing or providing a remedy for a vulnerability, thereby eliminating the risk of being exploited. Vulnerability scanning is used to identify and evaluate the security posture of a network. Historically, scanners were developed for specific purposes such as scanning only Windows desktops, applications, or network devices. SAINT offers heterogeneous scanning that identifies vulnerabilities across operating systems, desktop applications, network devices, Web applications, databases, and more.

SAINTexploit Penetration Testing Tool

The integrated penetration test

Penetration test

A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from malicious outsiders and malicious insiders...

ing tool, SAINTexploit, demonstrates the path an attacker could use to breach a network and quantifies the risk to the network. SAINTexploit includes a Web site emulator and e-mail forgery tool.

Penetration testing tools from SAINT are designed to simulate both internal and external real-world attacks. This type of testing identifies the methods of gaining access to a target and understanding the techniques used by attackers. There are many levels and types of penetration testing and the scope of the project should be well defined. Targets included in the scope could include popular protocols, network devices, databases, Web applications, desktop applications, and various flavors of operating systems.

SAINT focuses on the development of exploits where a shell can be established. A shell, or shellcode, is where all exploits included offer a command shell/direct connection to the target from the computer performing the testing. Exploits target operating systems, desktop applications, databases, Web applications, protocols, and network devices. The most common exploit types included in SAINTexploit include the following:

• Remote Exploit – These attacks are launched across the Internet or network against a vulnerable target without the user having previous access to the system.

• Client Exploit – The victim must access the attacker’s resource for a successful attack to take place. Common client exploits include e-mail forgery attacks, enticing the user to visit a Web site, or to open a file.

• Local Exploit – In order to launch a local attack, the attacker must have previous access to the victim. (Also known as privilege elevation and tunneling). In this case, the victim's machine is used as the launch pad for connecting to other vulnerable targets.

SAINTmanager Remote Management Console

SAINT’s remote management console, SAINTmanager, enables enterprise-wide vulnerability scanning. The browser-based console provides the ability to centrally manage an entire network of SAINT vulnerability scanners from a single interface.

WebSAINT and WebSAINT PRO SaaS Models

These Software as a Service (SaaS) models enable cloud based vulnerability scanning, penetration testing, and compliance audits without having to download and install software.

History

The SAINT (Security Administrator's Integrated Network Tool) network vulnerability scanner was based on SATAN

Security Administrator Tool for Analyzing Networks

The Security Administrator Tool for Analyzing Networks is a testing and reporting toolbox that collects a variety of information about networked hosts and was considered one of the best when written. In fact, it was the first truly user-friendly network scanner...

 (Security Administrators Tool for Analyzing Networks) which was developed by Dan Farmer

Dan Farmer

Dan Farmer is an American computer security researcher. In a summer course in 1989, in order to graduate from Purdue University he started the development of the COPS program for identifying security issues on Unix systems under Gene Spafford, first releasing it after leaving Purdue in late 1989...

 and Wietse Venema

Wietse Venema

Dr. Wietse Zweitze Venema is a Dutch programmer and physicist best known for writing the Postfix email system. He also wrote TCP Wrapper and collaborated with Dan Farmer and Samuel Johnson to produce the computer security tools SATAN and The Coroner's Toolkit.-Biography:He studied physics at the...

 and released in 1995. SAINT Corporation (formerly World Wide Digital Security, Inc. (WWDSI)) continued development and released SAINT in July 1998. WWDSI changed its name to SAINT Corporation in January 2002.

SAINT products are developed by SAINT Corporation, headquartered in Bethesda, MD

Bethesda, Maryland

Bethesda is a census designated place in southern Montgomery County, Maryland, United States, just northwest of Washington, D.C. It takes its name from a local church, the Bethesda Meeting House , which in turn took its name from Jerusalem's Pool of Bethesda...

.

External links

• SAINT home page