SAINT (software)

The SAINT (Security Administrator's Integrated Network Tool) network vulnerability scanner was based on SATAN (Security Administrator Tool for Analyzing Networks) which was developed by Dan Farmer and Wietse Venema and released in 1995. SAINT Corporation (formerly World Wide Digital Security, Inc. (WWDSI)) continued development and released SAINT in July 1998. WWDSI changed its name to SAINT Corporation in January 2002.

SAINT products are developed by SAINT Corporation, headquartered in Bethesda, Maryland.

The SAINT scanner screens every live system on a network for TCP and UDP services. For each service it finds running, it launches a set of probes designed to detect anything that could allow an attacker to gain unauthorized access, create a denial-of-service, or gain sensitive information about the network. SAINT provides support to the Security Content Automation Protocol (SCAP) specification as an Unauthenticated Vulnerability Scanner and Authenticated Vulnerability and Patch Scanner. SAINT is also an approved scanning vendor with the Payment Card Industry (PCI).

The Four Steps of a SAINT Scan:

Step 1 – SAINT screens every live system on a network for TCP and UDP services.

Step 2 – For each service it finds running, it launches a set of probes designed to detect anything that could allow an attacker to gain unauthorized access, create a denial-of-service, or gain sensitive information about the network.

Step 3 – The scanner checks for vulnerabilities.

Step 4 – When vulnerabilities are detected, the results are categorized in several ways, allowing customers to target the data they find most useful.

SAINT can group vulnerabilities according to severity, type, or count. It can also provide information about a particular host or group of hosts. SAINT describes each of the vulnerabilities it locates; references Common Vulnerabilities and Exposures (CVE), CERT advisories, and IAVA (Information Assurance Vulnerability Alerts); and describes ways to correct the vulnerabilities. In many cases, the SAINT scanner provides links to patches or new software versions that will eliminate the detected vulnerabilities. A vulnerability is a flaw in a system, device, or application that, if leveraged by an attacker, could impact the security of the system. Exploits take advantage of a vulnerability by compromising or destructing the vulnerable system, device, or application. Remediation is the process of repairing or providing a remedy for a vulnerability, thereby eliminating the risk of being exploited. Vulnerability scanning is used to identify and evaluate the security posture of a network. Historically, scanners were developed for specific purposes such as scanning only Windows desktops, applications, or network devices. SAINT offers heterogeneous scanning that identifies vulnerabilities across operating systems, desktop applications, network devices, Web applications, databases, and more.

The integrated penetration testing tool, SAINTexploit, demonstrates the path an attacker could use to breach a network and quantifies the risk to the network. SAINTexploit includes a Web site emulator and e-mail forgery tool.Penetration testing tools from SAINT are designed to simulate both internal and external real-world attacks. This type of testing identifies the methods of gaining access to a target and understanding the techniques used by attackers. There are many levels and types of penetration testing and the scope of the project should be well defined. Targets included in the scope could include popular protocols, network devices, databases, Web applications, desktop applications, and various flavors of operating systems.

SAINT focuses on the development of exploits where a shell can be established. A shell, or shellcode, is where all exploits included offer a command shell/direct connection to the target from the computer performing the testing. Exploits target operating systems, desktop applications, databases, Web applications, protocols, and network devices. The most common exploit types included in SAINTexploit include the following:

• Remote Exploit – These attacks are launched across the Internet or network against a vulnerable target without the user having previous access to the system.

• Client Exploit – The victim must access the attacker’s resource for a successful attack to take place. Common client exploits include e-mail forgery attacks, enticing the user to visit a Web site, or to open a file.

• Local Exploit – In order to launch a local attack, the attacker must have previous access to the victim. (Also known as privilege elevation and tunneling). In this case, the victim's machine is used as the launch pad for connecting to other vulnerable targets.

SAINT’s remote management console, SAINTmanager, enables enterprise-wide vulnerability scanning. The browser-based console provides the ability to centrally manage an entire network of SAINT vulnerability scanners from a single interface.

SAINTCloud enables cloud based vulnerability scanning, penetration testing, and compliance audits without having to download and install software.

The products that are available from SAINT Corporation includes the SAINT Security Suite, the Tr-3, BB-9, SAINTcloud, SAINTbox Appliance, and SAINT for AWS. The SAINT Security Suite includes products for vulnerability management, configuration assessment, social engineering, penetration testing, asset management, advanced analytics, incident response, reporting, and third-party integration.