Which of the following vulnerability scanner scans from CGI, IDA, Unicode, and Nimda vulnerabilities?

Hackbot was a simple, automated Perl script scanner that became prevalent in the early 2000s. It was specifically designed to scan IP address ranges for a narrow set of well-known Microsoft Internet Information Services (IIS) vulnerabilities. Its primary checks included the Unicode directory traversal vulnerability, the .ida/.idq vulnerability (exploited by the Code Red worm), and other CGI-related weaknesses. The Nimda worm exploited several of these same vulnerabilities, making Hackbot a common tool used by attackers to find systems susceptible to Nimda and similar threats of that era.

B. SARA: The Security Auditor's Research Assistant (SARA) was a more comprehensive, Unix-based vulnerability scanner, not one specifically limited to the listed web server vulnerabilities.
C. Nessus: Nessus is a modern, broad-spectrum vulnerability scanner. While it can detect these historical vulnerabilities, it is not defined by this specific, limited set of checks.
D. Cgichk: This tool is too specific, as its function is to check exclusively for Common Gateway Interface (CGI) vulnerabilities, not the IDA, Unicode, or Nimda-related issues.

1. Spitzner

L. (2001). Know Your Enemy: Honeynets. SANS Institute InfoSec Reading Room. In this SANS presentation

hackbot.pl is explicitly identified as a scanner used by attackers to find vulnerable IIS webservers by checking for vulnerabilities exploited by Code Red and Nimda. (See slide/page on "Scans").

2. Cheung

S.

Lindqvist

U.

& Fong

M. W. (2003). A framework for network forensics. Proceedings of the 2003 IEEE International Conference on Systems

Man and Cybernetics

1

79-85. https://doi.org/10.1109/ICSMC.2003.1243798. This academic paper mentions "Hackbot" as an example of a tool used by attackers for reconnaissance (Table 1

page 82).

3. Columbia University. (c. 2003). COMS E6998-005: Intrusion Detection Systems Project 2: Attack Generation. Courseware. This project assignment from a Columbia University computer science course lists hackbot.pl as a known attack tool to be analyzed

describing it as a "web server vulnerability scanner."