The SATAN configuration file

1. Attack Level
2. Which Probes Correspond to the Attack Level
3. The What's and Where's of the Current Probe
4. Timeouts
5. Timeout Signals
6. Proximity Variables - IMPORTANT
7. Trusted or Untrusted
8. Targeting Exceptions
9. Workarounds: DNS, ICMP

This file is nothing more than perl code that gets run when the program initializes; don't be intimidated by that, however - it is fairly easy to read and is heavily commented (if you don't know perl, comments (lines that don't do anything) are lines that start with a sharp/pound sign ("#")). Variables are tokens that start with a dollar sign; values of 0 or null ("") typically mean false, unless otherwise noted.

The easiest way to explain all of the options is by simply going over each line in the file and explain what it does:

Attack Level

    # Default attack level (0=light, 1=normal, 2=heavy)
    $attack_level = 0;

Which Probes Correspond to the Attack Level

However, there is one twist; not all probes are run, even though they might be listed under an attack level. If a SATAN probe has a question mark ("?") appended to its name, it will run conditionally. What does this mean? Take, for instance, the NFS SATAN checker. There is no reason to run it if the remote system isn't running NFS (indeed, you shouldn't run it, because the program will waste time timing out on the remote host), so SATAN will only run this if it determines that NFS is being run.

So, examining the first few lines in this section reveals:

    # Probes by attack level.
    #
    # ? Means conditional, controlled by rules.todo. * Matches anything.
    @light = (
            'dns.satan',
            'rpc.satan',
            'showmount.satan?',
            );

This means that a light scan will run the dns.satan and the rpc.satan scans, and the showmount.satan if SATAN determines that the target is running NFS.

A bit further down shows:

    @normal = (
            @light, 
            'finger.satan', 
            'tcpscan.satan 70,80,ftp,telnet,smtp,nntp,uucp', 
            'udpscan.satan 53,177',
            'rusers.satan?', 
            'boot.satan?',
            );

    @heavy = (
            @normal,
            $heavy_tcp_scan = 'tcpscan.satan 1-9999',
            $heavy_udp_scan = 'udpscan.satan 1-2050,32767-33500',
            '*?',
            );

    # status file; keeps track of what probe is currently running and at what time it started
    $status_file = "status_file";

    # timeout values
    $slow_timeout = 60;
    $med_timeout = 20;
    $fast_timeout = 10;

Some tools need more time, such as the nfs checker, or the port scanner when many ports are to be scanned. For this reason you override the default timeout for specific tools. Examples:

    %timeouts = (
            'nfs-chk', $slow_timeout,
            $heavy_tcp_scan, $slow_timeout,
            );

Timeout Signals

    # what signal we send to nuke things when they timeout:
    $timeout_kill = 9;

Proximity refers to how close the current target is from the original target of the SATAN probe. For instance, if you probe victim.com and find that nic.ddn.mil is its nameserver, then nic.ddn.mil's proximity level would be "1", and SATAN might probe that host next, depending on the rules you choose.

The number of hosts SATAN scans can grow exponentially, so again, be careful!

    #
    # Proximity variables; how far out do we attack, does severity go down, etc.
    #
    # how far out from the original target do we attack?
    $max_proximity_level = 0;

As SATAN gets farther away from the primary target, the attacks will get weaker - this presumes that you can attack your own sites as much as desired, but since you might not know where SATAN will end up, you'd like to be cautious the farther away the probes are going from your own host.

    # Attack level drops by this much each proximity level change
    $proximity_descent = 1;

If the attack level goes below zero, do you stop or go on? The "$sub_zero_proximity" variable determines this:

    # when we go below zero attack severity, do we stop (0) or go on (1)?
    $sub_zero_proximity = 0;

    # a question; do we attack subnets when we nuke a target?
    # 0 = no; 1 = primary target subnet
    $attack_proximate_subnets = 0;

    #
    # Does SATAN run on an untrusted host? (0=no; 1=yes, this host may appear
    # in the rhosts, hosts.equiv or NFS export files of hosts that are being
    # probed).
    #
    $untrusted_host = 0;

    $only_attack_these = "edu";

    #
    # If $only_attack_these is non-null, *only* hit sites if they are of this
    # type.  You can specify a domain (podunk.edu) or network number
    # (192.9.9). You can specify any combination of domains and or networks
    # as long as you separate them by whitespace and/or commas.
    #
    # Examples:
    #
    # $only_attack_these = "podunk.edu";
    # $only_attack_these = "192.9.9";
    # $only_attack_these = "podunk.edu, 192.9.9";
    #
    $only_attack_these = "";

    #
    # Stay away from anyone that matches these patterns.
    #
    #  Example - leave government and military sites alone:
    #
    # $dont_attack_these = "gov, mil";
    $dont_attack_these = "";

DNS

    # Set to nonzero if nslookup does not work.
    $dont_use_nslookup = 0;

ICMP

    # Set to nonzero if ICMP does not work.
    $dont_use_ping = 0;