WEBVTT 00:01.020 --> 00:02.189 Hey, everyone, welcome back to the 00:02.190 --> 00:03.758 course. So in the last video, we 00:04.019 --> 00:05.129 went ahead and logged in Kelly 00:05.130 --> 00:07.289 Linux, we then also created 00:07.290 --> 00:09.179 our text file with our NATO 00:09.180 --> 00:10.739 command and then we went ahead and 00:10.740 --> 00:12.299 loaded IP addresses in there so we 00:12.300 --> 00:13.769 could actually scan against those. 00:14.310 --> 00:16.199 And then we wrapped up that video 00:16.200 --> 00:18.029 with launching the open vast 00:18.030 --> 00:19.319 tool. And we were in the process of 00:19.320 --> 00:20.519 launching it. On one hand, pause 00:20.530 --> 00:22.019 video, as I mentioned, it takes 00:22.020 --> 00:22.979 several minutes to go ahead and 00:22.980 --> 00:23.759 launch it. 00:23.760 --> 00:24.989 Once it does, it will launch 00:24.990 --> 00:26.099 Firefox, as you see in the 00:26.100 --> 00:27.599 background there, and it will take 00:27.600 --> 00:29.070 you to the Green Zone security 00:29.160 --> 00:30.899 assistant login page right here in 00:30.900 --> 00:31.900 step 16. 00:32.189 --> 00:33.359 So you'll see that in the background 00:33.360 --> 00:34.360 there in my machine. 00:34.470 --> 00:35.999 Now, we're at step 17 here. 00:36.000 --> 00:37.019 We're going to go ahead and log into 00:37.020 --> 00:38.020 this particular page. 00:38.520 --> 00:39.929 So we'll login with the username of 00:39.930 --> 00:41.879 Admon. And then the password is 00:41.880 --> 00:44.130 Capital P, the at symbol 00:44.550 --> 00:46.649 and then lowercase SSW, 00:47.160 --> 00:48.336 the number zero and then 00:48.990 --> 00:50.130 lowercase R d. 00:50.170 --> 00:51.299 So let's go ahead and type that in 00:51.300 --> 00:52.199 now. So we're going to type in 00:52.200 --> 00:53.310 admin, all lowercase 00:54.420 --> 00:55.649 and then we'll type in our password 00:55.650 --> 00:57.689 here. So capital P the at 00:57.690 --> 01:00.479 symbol lowercase ssw 01:00.960 --> 01:02.909 the number zero and lowercase 01:02.910 --> 01:04.233 r d once you touch that and 01:04.739 --> 01:05.759 you can either hit enter your 01:05.760 --> 01:07.169 keyboard or just click on log in 01:07.170 --> 01:08.549 there and may ask you, do you want 01:08.550 --> 01:09.569 to remember. It doesn't matter. 01:09.570 --> 01:10.859 Then just go ahead and out or you 01:10.860 --> 01:12.810 can remember it, it has no 01:13.050 --> 01:14.489 bearing on the lab at all. 01:14.490 --> 01:15.719 So you're welcome to do what you 01:15.720 --> 01:17.129 want in that particular situation. 01:18.480 --> 01:20.250 Or so the next step here, step 18. 01:20.460 --> 01:21.899 We're going to go ahead and put our 01:21.900 --> 01:23.579 mouse over top of the configuration 01:23.580 --> 01:25.730 option and then select targets. 01:25.980 --> 01:27.269 So this one right here in the 01:27.270 --> 01:28.270 center. 01:28.460 --> 01:29.460 It's. 01:30.840 --> 01:31.799 All right, so it takes us to our 01:31.800 --> 01:32.800 target page here. 01:32.940 --> 01:33.839 So now what we're going to do is 01:33.840 --> 01:34.840 we're actually going to look this 01:34.860 --> 01:36.428 tiny little icon here that looks 01:36.810 --> 01:38.239 like a little white star. 01:38.430 --> 01:40.109 So it's a small blue colored button, 01:40.110 --> 01:41.519 as I mentioned, with a white 01:42.090 --> 01:43.199 colored star in the center. 01:44.100 --> 01:44.969 So we're going to go ahead and click 01:44.970 --> 01:45.839 on that. 01:45.840 --> 01:46.859 And that's going to allow us to 01:46.860 --> 01:47.789 create a new target. So it's 01:47.790 --> 01:49.079 actually going to open a pop up box 01:49.080 --> 01:49.919 for us when we do that. 01:49.920 --> 01:50.920 So go ahead and click on it. 01:51.750 --> 01:52.649 You'll see here in a second. 01:52.650 --> 01:54.239 It opens up this paper box for us 01:54.810 --> 01:55.859 and we'll go ahead and get some of 01:55.860 --> 01:57.149 these fields filled out. 01:59.340 --> 02:00.149 All right. So first thing we're 02:00.150 --> 02:01.439 going to do here is step one. 02:01.470 --> 02:02.639 We're going to go ahead and in the 02:02.640 --> 02:04.310 name box type incorporate devices. 02:04.320 --> 02:06.329 So this top box here, just 02:06.330 --> 02:07.379 go ahead and type in corporate 02:07.380 --> 02:08.380 devices. 02:11.160 --> 02:12.924 And then in our comment field, we're 02:12.930 --> 02:14.339 going to type in. These are devices 02:14.340 --> 02:15.239 on the network. You don't need the 02:15.240 --> 02:16.199 quotation marks. 02:16.200 --> 02:17.970 I just wanted you to know that was a 02:18.120 --> 02:19.120 basically a statement there. 02:19.230 --> 02:20.350 So these are the devices. 02:20.370 --> 02:21.749 These are devices on the network. 02:22.050 --> 02:23.279 So go and type that in the common 02:23.280 --> 02:24.179 box. 02:24.180 --> 02:26.189 These are devices on the network. 02:30.100 --> 02:31.719 All right, so 02:32.320 --> 02:33.549 now what we're going to do on step 02:33.550 --> 02:35.559 23 under the hosts 02:35.560 --> 02:36.819 of this this third 02:37.390 --> 02:38.958 option down here, we're going to 02:39.130 --> 02:40.749 select the from file option 02:41.560 --> 02:42.459 and then we're going to go ahead and 02:42.460 --> 02:43.460 browse. 02:44.470 --> 02:45.789 So we've went ahead and we select 02:45.790 --> 02:47.050 the from final option. 02:47.200 --> 02:48.200 We're browsing now. 02:48.940 --> 02:50.139 You'll see it's open a window in the 02:50.140 --> 02:51.140 background there. 02:51.160 --> 02:52.419 What I want you to do now is click 02:52.420 --> 02:53.439 on the student folder. 02:54.040 --> 02:55.409 So it's down here at the bottom left 02:55.540 --> 02:56.439 hand. Click on that. 02:56.440 --> 02:57.399 And then now you're going to see the 02:57.400 --> 02:58.779 file that we created, a scanning 02:58.780 --> 02:59.780 target list one. 03:00.700 --> 03:01.700 Go ahead and click on that one 03:03.280 --> 03:04.629 and then select the open button. 03:06.790 --> 03:07.809 All right. Let's go back to our lab 03:07.810 --> 03:08.810 document. 03:08.890 --> 03:10.119 So we've gone here and we took the 03:10.120 --> 03:11.319 student folder. We clicked on the 03:11.320 --> 03:12.839 file that we had created and we 03:13.000 --> 03:14.139 select the open button. 03:15.100 --> 03:16.815 So our last step at this particular 03:16.930 --> 03:18.159 screen is going to be clicking on 03:18.160 --> 03:19.089 the create button at the very 03:19.090 --> 03:20.439 bottom. Right. So let's go and do 03:20.440 --> 03:21.580 that now. Click on that. 03:22.870 --> 03:24.220 Closed a little pop up for us 03:25.450 --> 03:26.379 or let's go back to our lab 03:26.380 --> 03:27.380 document. 03:29.360 --> 03:31.149 All right, so our next step here is 03:31.150 --> 03:32.865 step 29, we're going to go ahead at 03:32.900 --> 03:34.340 the very top of the screen here. 03:34.550 --> 03:35.629 We're going to click on and we're 03:35.630 --> 03:36.560 going to cover our mouseover over 03:36.561 --> 03:38.029 top of the scans option 03:38.390 --> 03:39.830 and then we're going to select TASC. 03:40.640 --> 03:41.659 So it's going to do the analysis 03:41.660 --> 03:42.889 scans and then you're going to see 03:42.890 --> 03:44.179 TASC, right. They're going to go 03:44.180 --> 03:45.180 ahead and click on that one. 03:47.570 --> 03:48.799 You might get this little pop up 03:48.800 --> 03:50.059 here. If you see that, you can x out 03:50.060 --> 03:51.229 of it or you just wait until that 03:51.230 --> 03:52.847 time runs out either way to close 03:53.330 --> 03:54.919 it. So I'm just going to X out of it 03:54.920 --> 03:56.029 to save us some time there. 03:56.030 --> 03:57.030 A couple of seconds. 03:57.800 --> 03:58.789 So you'll see step 30. 03:58.790 --> 04:00.079 That was a little paperbarks again. 04:00.080 --> 04:01.249 You can just leave it alone for like 04:01.250 --> 04:02.818 six or seven seconds and it will 04:02.960 --> 04:03.960 close for you. 04:04.220 --> 04:05.389 The next thing where you were to 04:05.390 --> 04:06.860 click back on these small blue 04:07.160 --> 04:08.300 colored button again, that's that 04:08.320 --> 04:09.619 same one with the whites are in the 04:09.620 --> 04:11.419 center and we're going to select new 04:11.420 --> 04:13.009 task. So let's go and do that now. 04:13.010 --> 04:14.627 So you'll see if I hover my mouse 04:14.660 --> 04:16.228 over top, it gives me a new task 04:16.579 --> 04:17.629 option. I want to go ahead and click 04:17.630 --> 04:18.708 on that and you'll see 04:19.519 --> 04:20.989 it open up some more fields for us 04:20.990 --> 04:21.990 to fill out. 04:23.180 --> 04:24.169 So we're going to type in the name 04:24.170 --> 04:25.249 field. We're going to type corporate 04:25.250 --> 04:26.659 scan. So let's go and do that now. 04:26.660 --> 04:27.660 So it's top on here. 04:27.920 --> 04:28.999 What is going to type in corporate 04:29.000 --> 04:30.000 scan? 04:31.160 --> 04:32.329 And if you remember in the last one, 04:32.330 --> 04:33.949 we typed in corporate devices. 04:34.340 --> 04:35.569 So now we're just going to specify 04:35.570 --> 04:36.739 that, hey, this is a corporate scan 04:36.740 --> 04:38.449 is associated with those particular 04:38.450 --> 04:39.450 devices. 04:39.920 --> 04:40.879 All right. So all we're going to do 04:40.880 --> 04:42.019 there is actually change the name. 04:42.020 --> 04:43.020 We're just going to now click the 04:43.100 --> 04:44.059 button at the bottom. Right. 04:44.060 --> 04:45.060 So let's go and do that. 04:45.980 --> 04:47.599 And what you'll see here in a second 04:47.600 --> 04:49.759 is you'll see a line here 04:49.760 --> 04:50.760 with our scan. 04:50.960 --> 04:52.577 And the way we go ahead and start 04:52.610 --> 04:53.959 our scan is this little. 04:55.150 --> 04:56.571 The white arrow in it, you'll 04:56.980 --> 04:58.839 see if I have my mouse over top, it 04:58.840 --> 05:00.249 shall start and then we're just 05:00.250 --> 05:01.320 going to go ahead and start that. 05:02.170 --> 05:03.249 Now it's going to go ahead and run 05:03.250 --> 05:05.199 the scan 05:05.200 --> 05:06.200 in the background there. 05:06.580 --> 05:07.809 Now, it may take five to 10 minutes 05:08.050 --> 05:09.050 to complete. 05:09.280 --> 05:10.329 The next thing I actually want you 05:10.330 --> 05:11.996 to do while it's going going ahead 05:12.220 --> 05:13.837 and running is up here at the top 05:14.350 --> 05:15.990 where it says no auto refresh. 05:16.540 --> 05:18.069 Go ahead and just click on that box 05:18.070 --> 05:19.638 and then choose refresh every 30 05:19.750 --> 05:21.416 seconds. So that way, as it starts 05:21.730 --> 05:23.259 to complete, you'll start knowing, 05:23.260 --> 05:25.029 like, OK, it's almost complete and, 05:25.030 --> 05:26.379 you know, to be able to come here 05:26.530 --> 05:27.530 and click on it. 05:28.540 --> 05:29.829 Now, as I mentioned, the scan is 05:29.830 --> 05:30.699 going to take about five to 10 05:30.700 --> 05:31.700 minutes to complete. 05:31.840 --> 05:33.129 So I'm going to go and pause video 05:33.130 --> 05:35.019 here once it completes on my 05:35.020 --> 05:36.279 end or go ahead and pick back up the 05:36.280 --> 05:37.869 video. And what you'll notice once 05:37.870 --> 05:39.536 it's completed is we'll see a date 05:39.910 --> 05:41.169 here that we can go ahead and click 05:41.170 --> 05:42.170 on. 05:43.360 --> 05:45.124 All right, so it's finished scanning 05:45.550 --> 05:47.314 finally now, moving through a couple 05:47.410 --> 05:48.909 of error messages, so that's what 05:48.910 --> 05:50.589 kind of took so long to come back on 05:50.590 --> 05:51.590 the video. 05:51.730 --> 05:53.589 So basically, as it was scanning, it 05:53.590 --> 05:54.590 would throw in air. 05:55.180 --> 05:56.859 If it does that, I forget the exact 05:56.860 --> 05:58.360 air code, but just click the 05:58.720 --> 05:59.979 browser back button and that will 05:59.980 --> 06:01.401 take you back to the scanning 06:01.810 --> 06:03.427 page and eventually should finish 06:03.850 --> 06:04.850 successfully. 06:05.590 --> 06:07.059 Not like I said, just take a moment 06:07.060 --> 06:08.726 or so to get finished out, but you 06:09.100 --> 06:10.717 eventually should see it finished 06:10.720 --> 06:12.310 and then you'll want to click on 06:12.550 --> 06:13.550 the last page should 06:14.410 --> 06:15.540 be available pretty click on. 06:15.940 --> 06:17.199 Now, if it's not for some reason, 06:17.200 --> 06:18.880 just go to scans and then TASC 06:19.150 --> 06:20.469 basically that should try to refresh 06:20.470 --> 06:22.087 it and then you should be good to 06:22.240 --> 06:23.759 go. The ultimate goal is to get 06:24.100 --> 06:25.100 here where we have 06:26.020 --> 06:27.429 a listing of all the vulnerabilities 06:27.430 --> 06:28.749 that is found. Now, the cool thing 06:28.750 --> 06:29.750 about this and 06:30.880 --> 06:31.880 for that, I want 06:32.770 --> 06:34.329 you to answer question one here. 06:34.340 --> 06:36.279 So what vulnerabilities do you see 06:36.280 --> 06:37.329 on the report, if any? 06:37.690 --> 06:39.279 On my end, obviously, you can see 06:39.280 --> 06:40.209 there I have quite a few 06:40.210 --> 06:41.210 vulnerabilities. 06:41.710 --> 06:43.089 And then, of course, number two kind 06:43.090 --> 06:44.139 of ties into what I was about to 06:44.140 --> 06:45.806 mention, what other information is 06:45.940 --> 06:47.439 provided in the report besides just 06:47.440 --> 06:49.149 listing out of vulnerability, 06:49.510 --> 06:51.249 what other information is available 06:51.250 --> 06:52.250 for us now on your 06:53.170 --> 06:54.700 own? If you want to go in the video, 06:54.940 --> 06:57.009 look through all of these items 06:57.010 --> 06:57.969 that you find. 06:57.970 --> 06:59.199 So feel free to look through all of 06:59.200 --> 07:00.639 them, go through different pages, et 07:00.640 --> 07:01.640 cetera, 07:02.800 --> 07:04.417 and jot down what information you 07:04.450 --> 07:06.214 see. So, for example, here we see we 07:06.220 --> 07:07.480 do have a severity level. 07:08.020 --> 07:09.686 So 10 being the highest, 10 out of 07:09.790 --> 07:11.649 10, not a good thing by 07:11.650 --> 07:12.650 any means. 07:12.670 --> 07:14.139 We've also got the 07:14.560 --> 07:16.569 IP address here as well 07:16.570 --> 07:17.570 as the port that 07:18.610 --> 07:19.610 we're running on. 07:20.350 --> 07:22.329 And then if we open these up, so 07:22.330 --> 07:23.659 we'll go ahead and click click on 07:23.660 --> 07:24.660 the stop on here. 07:24.710 --> 07:25.959 It's going to tell us some information 07:25.960 --> 07:27.369 about that particular vulnerability 07:27.370 --> 07:29.079 that we're finding. So tell me tell 07:29.080 --> 07:30.939 us the key codes, if 07:30.940 --> 07:32.169 there are any. Assuming so, there 07:32.170 --> 07:33.170 should be. 07:33.400 --> 07:34.419 It also tell you some other 07:34.420 --> 07:36.339 supporting documentation or websites 07:36.340 --> 07:37.749 that you can go to to find out more 07:37.750 --> 07:39.073 about it. And it also, as I 07:39.550 --> 07:40.779 mentioned, gives you kind of a brief 07:40.780 --> 07:42.005 summary of the particular 07:42.820 --> 07:43.820 vulnerability. 07:45.860 --> 07:47.149 All right, so the last step of 07:47.150 --> 07:48.529 related documents is basically 07:48.530 --> 07:49.579 generating a report, 07:50.870 --> 07:52.159 and this is something that like if 07:52.160 --> 07:53.239 you were trying to give it to your 07:53.240 --> 07:55.129 boss or whatnot, this is 07:55.130 --> 07:56.659 something that you would want to go 07:56.660 --> 07:57.660 ahead and do. 07:58.580 --> 08:00.049 So I'm just going to back up here, 08:00.050 --> 08:01.429 so I'll go back to my main list 08:01.430 --> 08:03.145 there. Now, the way we get a report 08:03.410 --> 08:05.329 is here in this top left little 08:05.330 --> 08:06.330 drop down menu. 08:06.440 --> 08:07.369 We're just going to click on there 08:07.370 --> 08:08.689 and we're going to scroll down and 08:08.690 --> 08:09.770 choose PDF. 08:10.940 --> 08:12.319 And then this little down arrow 08:12.320 --> 08:13.969 right here, that's actually how we 08:13.970 --> 08:14.809 generate a report. 08:14.810 --> 08:16.699 So the download filter to report is 08:16.700 --> 08:17.870 the name of the option. 08:18.170 --> 08:19.219 If we go ahead and click on that, 08:19.220 --> 08:20.419 it's going to give us a pop up box 08:20.420 --> 08:22.309 here and then we can either save or 08:22.310 --> 08:23.310 open the report. 08:24.140 --> 08:25.879 It has not been opening for me in 08:25.880 --> 08:27.595 the lab here, so I just been saving 08:27.980 --> 08:29.269 it. It's kind of a proof of concept 08:29.270 --> 08:30.446 thing. But again, in the 08:31.100 --> 08:32.658 real world, you just download this 08:32.659 --> 08:33.933 and open it up and provide 08:34.549 --> 08:35.600 it to whoever needs it. 08:36.169 --> 08:37.428 But the main thing I want you to see 08:37.429 --> 08:38.839 after we ran open was, you know, 08:38.840 --> 08:39.840 close out. 08:39.890 --> 08:41.149 The main thing I wanted to see 08:41.150 --> 08:42.375 wanted you to see here is 08:43.070 --> 08:44.736 how much information Open provides 08:45.110 --> 08:46.879 back to us compared to the core 08:46.880 --> 08:48.559 impact, you know, the free scan that 08:48.560 --> 08:49.560 we ran earlier. 08:50.210 --> 08:51.649 This one's an open source tool. 08:51.650 --> 08:52.729 And look at the information. 08:52.730 --> 08:53.929 You know, it gives us the severity 08:53.930 --> 08:55.339 level. It gives us some 08:55.790 --> 08:57.529 information of location information. 08:58.100 --> 08:59.389 And then if we click on it, it gives 08:59.390 --> 09:01.009 us a description, et cetera, of that 09:01.010 --> 09:02.029 particular vulnerability. 09:03.320 --> 09:04.459 So in this video, we just wrapped up 09:04.460 --> 09:05.839 our discussion on open source. 09:05.840 --> 09:07.039 Again, that's a vulnerability 09:07.040 --> 09:08.869 scanning tool and one that's 09:08.870 --> 09:10.549 commonly used in the industry by 09:10.550 --> 09:12.710 defenders as well as attackers 09:13.850 --> 09:14.749 in the next module. 09:14.750 --> 09:15.589 We're just going to go ahead and 09:15.590 --> 09:16.789 wrap up our discussion for the 09:16.790 --> 09:17.689 entire course. 09:17.690 --> 09:19.609 Now, keep in mind as well that there 09:19.610 --> 09:21.049 are assessments for this course. 09:21.320 --> 09:22.669 Be sure to download the supplemental 09:22.670 --> 09:24.385 resources section so you'll get all 09:24.470 --> 09:26.509 this lab Step-By-Step Guides as 09:26.510 --> 09:28.520 well as the assessments. 09:29.150 --> 09:30.499 And so what I've done there is I've 09:30.500 --> 09:31.729 listed out the assessments you need 09:31.730 --> 09:33.347 to complete, sort of listed out a 09:33.470 --> 09:34.879 bunch of different map commands that 09:34.880 --> 09:36.469 I want you to run, listed out the 09:36.470 --> 09:37.970 lab you should go into to run those, 09:38.210 --> 09:39.830 as well as an assessment from 09:41.030 --> 09:42.409 Sadef on our site. 09:42.740 --> 09:44.000 That's for vulnerability 09:44.570 --> 09:46.219 assessment, so to speak, of finding 09:46.220 --> 09:47.690 vulnerabilities. So I want you 09:48.080 --> 09:49.759 to copy all of those as part of the 09:49.760 --> 09:51.319 kind of the capstone, so to speak, 09:51.320 --> 09:52.819 of the course, and then moving to 09:52.820 --> 09:54.139 the conclusion video where we kind 09:54.140 --> 09:54.860 of wrap things up.