All right, welcome back, everyone.
This is Rick's List and let's get started with Nessus Scanner.
All right, so let me open my virtual little box and give you the OK.
So as we as I promise our lab will be having a lot of companies from Windows 10 machine to Windows servers,
which will be having DNS and DCB running into IT services basically, and Web servers as well, which
is this.
This is the DNS and DSP servers running.
This is our calling machine, which we won't be using much for.
The scanner will be making use of database scanner as well.
Let it's down into the database servers.
Let me turn up the Windows Web Server, ASBA, but we need it and we need to have our what exactly we
need is we need to log into our scan, OK?
And what you need to do is, first of all, get to a Windows machine or maybe any machine.
OK, usually being in if you look at my ethical hacking course, I made use of Unix Linux distribution
basically for performing the Nessa's scanning, the one already scanning because we're being to the
Enterprise Network, will be making use of Windows Machine most of the time because that's what you
would be aware of a bit.
So what do you what you can start with this.
You can simply go and go and download the new scanner for that.
What you can do is you can just download.
And once you do that, you get the first link.
The topmost result, and from there you just have to mention your first name, last name and your email
address moment, you click get started, you get the activation key for this.
Now, once you do that, you will have to you will get an option for download as well.
So either once you fill up this form, you get to the download section or you can also search here as
well for download.
Nessus Essential.
And this would also be helpful for reach out to the download page here, you can search for Windows.
You are for 64, but operating system, you can download this option and once you agree and download
it on your system for 32, but you can go for this, you agree and get downloaded.
Now, this is not necessary, not just for windows.
You can even have it in the operating system.
You can download it on your beento machine.
You can have it for any any system.
Mac OS as well.
This you can see it is even available for callisthenics system to once it's done, once the system is
downloaded, you can click on open file and just go with whatever you ask for and go next, next, next.
And once you are done with all the stuff, just once again I think we lost.
OK, here we are.
So once we get this software, you just keep doing the next and at the end it might take some time and
the browser will automatically open up on on a board.
On our Web browser, where you just either you type in Manolete localhost, localhost, who's aged three,
four, OK, and this is where Nessus get connected.
And once you do that, it will ask you to connect SSL and it will ask you to either either get the license
or you can skip it.
And straight away enter the enter the license fee that you received on your email while when you have
initially done the registration.
Right, so that when you get the key, you just enter it.
And once you are done with all the stuff you can do this option, of course, you also have to create
the username and password.
Now, this is the free rarin you can access around 18, you can scan around 18 licenses.
This is completely a free system.
So this is how the dashboard really looks like.
And here you get an option for importing any file or new folders or new scan.
That's what we would be interested about.
We get to see all type of scan from postholes discovery where you can discover all the most basic networks
can advance, scan, advance, dynamic scan.
This is what you would be making use of once you are in the organizations.
That application desk is pretty much popular when it comes to the when it comes to the organization,
when it comes to the scanning the Web application itself.
Now, there are many, many these are all free.
And for them you don't really have to do.
You have to purchase any commercial license.
But for the rest of them, for compliance, for audit cloud infrastructure, where you can scan your
adjure GCP or maybe the cloud as well.
For that, you might need the upgrade for internal PCI networks.
And this is those victimises three point two, which is the latest version besides a scan immediately
for the organization who either manages or store credit card or any kind of payment, got information
in their organization.
In that case, they have to perform quarterly scan and then submit it for, you know, submit to the
ASV.
Is QSA basically who are the external auditor and who comes and then organization to submit those reports.
And in that situation, it becomes a mandatory if they don't do that and then they fall under some bad
ideas.
But there are many other MDM configured config audit.
This is mainly for organizations who have mobile device management.
And if, let's say there are, we allow employees to access organizational resources from the mobile
phone as well.
In that case, we can perform those audit as well.
And it becomes really crucial at the PCI quarterly external that just the one that I talked about,
this is the quarterly scan that we perform through PCI and Policy Compliance Audit and many other as
well.
Right.
So these are something which requires the upgrade.
There are some scan which is pretty free of cost, which you can also perform.
Want to cry ransomware, scan across your network, shadow broker's scan and many more.
OK, this is something which has been pretty much popular in the in the meantime, where the Intel EMV
security bypass scan was very much into, you know, in the news, many organizations were impacted
because of this.
So that's all about it.
And if I give you an idea about how the setting really looks like, you get a license, name, license,
host utilization, that's where you get to see how many license you can make use.
OK, 16, sorry.
And then you have advance option where you can have the how you can decide how your user interface could
really look like you can enable the logging option, performance security as well.
You can even have proxy servers in between so that your scanner will not be directly scanning the system.
There will be a server in between and through which all these scan would really go to.
OK, if you want to make use of any proxy server, you have to you have to enter the credential, the
IP address of the proxy servers board you are talking on maybe usually on AT&T.
That's the support number.
Then you have to mention or enter the user name and password as well as some server.
If you want.
Your scanner should send an e-mail about every status that the scan has been completed.
We have found some errors.
There are this is the report, quarterly report, all the stuff you if you want, all those data comes
to your mailbox or the.
Important people are the stakeholders, and you can make use of some customs here, you can.
What do you see currently direct signs which ensure that while in order to access it, it's it's an
insecure because we don't have a certificate upload it, that my browser is not able to trust this software
at this moment.
So because it's got to be localhost it right.
It's not a browser based or online application.
It's currently it's currently a kind of server.
You know, what you are making use of.
It is a necessary word which is running on your system.
So in fact, declined.
And the server is currently on the same system at this moment and the server is not really having any
certificates.
So in order to make sure it is trusted, you can actually make use of certificates and then submit it
usually in the enterprise network, how the system looks like usually in those in moment, that is a
dedicated server and that's where the Nessus software will be installed.
And Windows Server, nothing is really, you know, it is not really meant for any general purpose use
so everybody can come and then access to the server and start scanning this.
Right.
And this situation would be taking a dedicated system.
But in our case, we go to lab.
So we are making our own system to be installed for necessary server and password management scanner.
So this is where you get get to see what's the scanning and then everything notification option as well.
This is how the scanner really looks like.
And from the next session on what will be getting started with this scanning is.
But thank you so much.