Mac® Security Bible

21.2. Using SAINT and SAINTexploit

SAINT, for Security Administrator's Integrated Network Tool (www.saintcorporation.com), is another multi-platform vulnerability scanner. Like Nessus, it was previously open source and is now a commercial application. Prices range from $425 (for a 10-host license) to $1,885 (for a 250-host license) if you're purchasing a one-year subscription and from $730 to $2,892 for a perpetual license. A 15-day trial version, which scans only two IP addresses, is also available (http://download.saintcorporation.com/downloads/freetrial/saint-install-7.1.2.gz).

By itself, SAINT only reports possible vulnerabilities —just like Nessus. But an add-on program called SAINTexploit (licenses for which cost the same as for SAINT itself) can perform penetration testing —that is, trying to exploit the vulnerabilities that may exist (which can cause significant harm and therefore should only be done to computers you control) for the purpose of security validation.

Apart from the high cost, SAINTexploit has very few Mac-specific exploits, although it does include a number of Linux or cross-platform exploits that could theoretically affect a Mac. Nevertheless, as it's quite a powerful tool, I want to provide a quick overview of how to install and use SAINT on Mac OS X.

To get started with SAINT, follow these steps:

1. Download the Mac OS X version of SAINT from www.saintcorporation.com/my_account/download.html. If you're using the trial version rather than purchasing the full ...