🤖 Overview

MercuryBoard User Agent SQL Injection NASL is a detection script belonging to the Nessus vulnerability scanner, developed and maintained by Tenable. Despite the name referencing an SQL injection attack vector, this script is a legitimate, automated security assessment tool used to identify a known vulnerability in MercuryBoard forum software (CVE‑2006‑3931). The Nessus scanner, including this NASL plugin, is widely deployed by security professionals to audit web applications for exploitable weaknesses, making it a beneficial rather than malicious agent.

🌐 Technical Behavior

This specific NASL script (Plugin ID 22285) sends crafted HTTP requests to a MercuryBoard target, injecting SQL payloads into the User-Agent header to test for unvalidated input handling. Nessus scanners operate from a distributed network of IP ranges published by Tenable (e.g., 38.122.48.0/20, 64.39.96.0/20, and 208.74.120.0/21 as of 2025). The scanner performs a single, rate-limited HTTP request per target per plugin, with a default interval of 5 seconds between tests. The script uses standard HTTP/1.1 GET requests without custom headers beyond the malicious User-Agent string, and it validates responses by looking for specific database error messages (e.g., MySQL syntax errors) or benign responses from patched versions.

📋 robots.txt Compliance

Tenable’s Nessus scanner does not honor robots.txt directives; its documentation explicitly states that security scanning requires bypassing such rules to identify real-world attack surfaces. However, Tenable provides a port scan exclusion list and recommends that site owners whitelist Nessus IP ranges to prevent accidental blocking. The script itself, as part of a credentialed or uncredentialed scan, does not parse robots.txt.

🔍 Detection Indicators

The primary detection signature is the User-Agent string: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Nessus), or older variants containing libwww-perl. Behavioral fingerprints include a single, isolated request targeting /path/to/mercuryboard/index.php with an embedded SQL payload in the User-Agent header. The request may also include a Host: target header and a Connection: close. Nessus scans typically originate from Tenable’s known IP ranges and occur at intervals exceeding 30 seconds between distinct scans.

📊 Data Usage

Data collected by this NASL script is used exclusively for vulnerability assessment. The script reports whether the target is vulnerable (confirming SQL injection) or patched, and this finding is stored in a local or cloud-based Nessus report. No data is retained or used for AI training, search indexing, or analytics; the script is purely a deterministic test against the CVE‑2006‑3931 vulnerability.

⚙️ Rate Limiting Policy

Because this script is part of a security scanner that may trigger aggressive detection rules, web application owners should apply threshold‑based rate limiting (e.g., 10 requests per 60 seconds from a single IP) to distinguish legitimate scanning from denial‑of‑service attacks. The rationale is to allow Nessus scans to complete while preventing abuse by malicious actors who may mimic its User‑Agent pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.