All right, welcome back, everyone, disassociation this session is about.
We are going to get started with our very first scan and that's scanner.
OK, so before we do the scan, we the target range and to make our station more effective will be making
use of already infected machine, which is made portable to I'll give you a link to download this machine
so you can download it and upload on your watch and box what you can do.
Just just download the file, extract it and just double click on it.
If you already having what you machine in virtual box on your system, it will open up so you don't
really have to worry about it.
So what's the IP address of the system then.
Not ziggurat one, not 40.
All right.
So let's get to our Nessa's scanner.
And on here we can perform the new scan.
And what you can do is you can actually make use of the hosken pretty Burack.
And this is where you can simply go to the network, scan the network and what you can what you can
do is you just specify the system itself.
Let's say we are performing the whole scan.
And let's specify the IP address of it, so the IP address below zero one dot 14.
OK, so that's where you define the target IP address.
And there are two things.
Remember, there's a credentialed scan or there's not credentialed scan.
If you have credentials of the system, the scanner can log into the system and then perform this Candice's.
This is very much a kind of active scan where you get more vulnerability and more, you know, more
data about the system.
If you don't really provide any credentials, that would be it would try to gather information, which
is, you know, which is available from the external world, external posture, in fact.
So we can we can make use of it.
It depends on how you want to specify if if you just if you want to make sure that you specify the details,
you can even make use of this.
You can simply provide the username and password for our condition.
It is a massive, massive and meaningful.
If you don't provide, it will still be OK, because any which way we are trying to understand how how
the problem, how the vulnerabilities are looking like from the external point of view without even
getting access to the system.
If somebody have the access to the machine, he don't really he don't need to perform any one of the
right.
He can straight away get access to the system.
Right.
So we can even if we do, if we even if we remove the credential, it still be OK.
So let me do more and let's see if we get the desired information about it.
OK, you still have an option of scheduling it.
You can schedule when you want to initiate this scan, you can have notification.
But notification only works when you have a same type configuration so that you get the email notification
as well.
So this is all in terms of basic board scan.
So once it is done, then on the target you see a plug ins in the normal network scan.
It is fixed.
You can't really modify what are plug ins.
Plug ins are basically a set of parameters against which all the all the vulnerabilities are matched.
So what happened is the way we have learned about the CBS database.
Right.
So in the plug ins for all of these KVI databases are basically updated with witnesses.
So Nessa's maintain all the weaknesses of all kind of host, maybe to Windows, maybe Linux machine,
you know, all the application, maybe Cisco routers such as Juniper, everything for every devices
maintains a kind of a plugin database.
And this these are all these plug ins are all compared against our target post.
And if any weakness of our target pulls matches with the plugins, the CB database, then it generates
in Halep.
So it's pretty, pretty, pretty clear what exactly it is going to come of.
So once that is done, you can straight away save it.
And so we have selective degradation.
So in that case we'll have to mention the password.
So let's say we will specify, OK, we can either ignore it, but let's say for this scan we keep the
password.
We mentioned the password and we then go ahead with this, OK?
Because we have already selected it.
So let's save it.
And once at the same, you get to see, OK, this you can log on to this.
OK.
One, if not, the scan will be will be started and it's already started.
So that's how you can perform it.
This is a credential B scan.
You can even make use of non-trading to scan where you can quickly mention, you know, scan, let's
extend or zero to 114.
And that's a you just have to do that and it's done.
And you can even initiate this scan is right.
So for now, I can just I can just pass this scan.
Let's wait for the scan to be completed.
Now, it might take some time.
Forget all the details about the scanning.
But meanwhile, we can see that we go to the system and the go and get a look at the one.
You see this, you get the most information.
So currently we have just one IP address because we have intentionally mentioned just one IP address.
Right.
If we if we mention all the database of the IP address, we can even imported as well.
Then you get to see all the system IP address in that situation.
Right.
And then you get the list of vulnerabilities.
So you see what is doing the red.
That's the most critical one.
What do you see in the mix?
This is the mediocre you can see over here.
Right.
And this is the high vulnerability, which is no bad one, really.
And it's a history which gives you an idea about what all that is happening.
You also for everyone, you you don't get the problem.
You even get the recommendation as well by Nessus.
So let's say this is the most critical one.
As of now, the scanning is not yet completed.
It's still going on.
But in meanwhile, we can look at some of the recommendations as well.
So you can see this is a description which says at least one of the NAFS chair exported by the remote
server could be mounted on the body scan host.
An attacker may be able to leverage this to read files on the remote post.
So this is something which can leverage the attacker to read the remote machine.
Right.
And the solution is configure.
And if it's on the remote post so that only authorized hosts can monitor what each remote shares.
So that's the recommendation.
And in order for two to know more about this one, you can even go and read more about it.
So this is where the Wallabadah Information Stream.
Let me maximize it so you can see the CB information, which curves are our match with this system weaknesses,
right?
So this is DCB.
Once you click on it, you get to the database or you can even manually go to the CB as well and can
know about all that exists.
As of now, we have made we have been making use of CVD.
If you remember correctly, we can make use of KVI details as well, and we can even go there and copy
any one of CB.
And we get into this and you know what, you get the exact same information, right?
This is seven point five when it was discovered and all this information you.
Sorry, I think it is correct.
Oh, yeah.
This is the absolutely correct.
That point five and this is the information about the celebrity.
And this is this is considerably information and disclosure, but potentially a data breach kind of
system as well.
So everyone them really you can copy it and get to our our you know, our favorite CVT is dot com as
well.
So through that, you can get more information.
Meanwhile, you can see the one body scan is still going on.
But at this moment, we have got around thirty seven weaknesses.
So 37 vulnerabilities.
If you look at the first one bandshell back detection, this is seems to be very critical.
And in this situation, you can still get to know as well as listening to on VAP on a remote boat without
any authentication.
So that seems like the shell on the system, which is listening to a boat.
That means the system is already infected with malware and it is listening for a session, listening
for a connection coming in from the attacker site.
So this seems to be very risky and this is not a sign of weakness, but this is something where I mean,
weaknesses in this is not seems to be a kind of KVI.
This is an already infected machine because we have we have chosen it.
Right.
So this is something where we have to find which file it is, which is listening for the system.
And then we get we have to either delete that system and stop that process ideas on the remote machine.
So this is the following output which has been observed based on the process itself and.
Yeah, there are many stuff which is our organ service detection, our service detection, sandack,
these are all application.
There are some weaknesses related to SSL, DNS service related challenges as well.
There are, of course, there are some issues related to SSL, which you can see it this way.
It says that openness is a package, random number, generator weaknesses.
And this seems to be, of course, as it was expected, this was found to be related to some 100.
You can again, go on to KVI and you can search for it and you probably get more information.
So you can see this is, again, one liberty on the system.
So now this is really helpful.
We have started with just one initially and we have reached 69 one already on the system.
And for when you start walking in for the real project or real involvement in a company, you get to
see this.
This is something which is this is something which, you know, in the organization there are security
analyst who runs this scanning for all the hosts, either monthly or weekly basis.
So it runs for all the system, all the routers such as firewalls and and for you have even the devices
which are responsible for security and securing the network.
They could also have vulnerability.
And this kind of scanner also perform scanning against those platform as well.
So the scan scanner performed the scan.
This network scanner performs the vulnerability scanning against the routers, switches, servers and
hosts of application everything.
And the once the report comes and that comes to their e-mail box, they comes, they download a spreadsheet
and then share across multiple department.
So let's say there are a set of weaknesses that have vulnerabilities for router.
It would be shared for the network team.
If there are a set of vulnerabilities on the firewalls, it would be shared to the firewall team.
If it is set up for what is on the application, it would be shared with the application.
Why?
The reason is there could be some time false positive.
I mean, that could be something.
This is these are all something which is very much accurate that and we have a specific comparison about
a specific CBE, but there are some recommendations coming in as well.
Right.
Informational details as well.
What do you see in this informational barometer as well?
Right.
So these are informational detection in that situation.
It would be shared with the concern team.
And they they inform you back or they mentioned in the report saying that, OK, this is something which
we can avoid at this moment.
And this is this could be a false positive.
Right.
Which is detected.
But this is false, OK?
And if they find that this is really the critical one, of course, the one which is matching the DCB,
they have to fix it and they will get it fixed as soon as possible and they will give us the report.
And this will be going to the risk management team as well, or the security management as a part of
their ROOPI, see a risk management planning as well.
All right.
So this is all about just getting in.
The next session will look at you for, you know, further replication scan that would scan and advance
scan as well.
Thank you.