All right, folks, so the wait is finally over, we are ready to scan our first host, our first machine.
The scan is about a complete horse scan.
What is our target for this?
We are going to make our US profitable spy machine as our target host.
The reason we are actually going to get a lot, just like with Nesson next Nessus, we are expected
to see a lot of vulnerabilities.
And that that also gives us a better understanding about, you know, what you can really see when a
one, a vulnerable system comes across your scanning.
All right.
So without taking much time, let's go to your DBM.
All right.
It's all start with configuring douget.
OK, so let's go to the douget.
All right.
And over here, the first step is to create the.
Machine.
OK.
So let me put a name made exploitable.
All right, what's the IP address, the IP address, if I remember correctly, the standard.
Zetterlund.
One point one forty one.
OK, if you have a list of holes that you want to target, you can even browse it, or probably you
can have a network as well.
You can define the entire subnet as well.
You can even exclude it if you have multiple targets.
So you can have a feudalist next comes in the portals and there are sixty five thousand ports available.
You can allow us to scan for all those ports, but including all of them might take a whole lot of time.
But leaving one anyone can lead to a problem as well.
Right?
So that's why the best practices to or I would say the best solution is to go with the open mass default.
This is basically a best practice.
The most popular ports are already being included.
Now, there is another option called like this.
This is nothing but an option where you can customize what kind of a scan of what kind of a probe you
want your open sky open mass to send.
Usually by default, it can make use of ICMP go.
But if the target hose doesn't really allow the ICMP to respond, you can even make use of DCPI Echo
as well.
OK, so there are variety of options.
You can probably make use of those.
When we start learning about the and map we get to know about, there are DCP and BCB, you know, DCB
scan and multiple other stuff where we form either half open session or complete three way handshake.
And of course the DCP goes to put those.
This will keep it defined.
Now the next Gamson, the credential for authenticated check.
This is very, very important.
If you make use of it, then only you will get to know the entire inside of the target host.
OK, you once you drag and drop, you can, you know, get to know about the list of credentials that
you have stored.
You can possibly I already have a list of know credential available.
You can create your own username password the way you want it.
You can go to the configuration, Dowbiggin, and under that you will select the option of credentials
and you can make a file of your all credentials or you get even created out of cohered so that if I
don't have any, the first thing I can just click on it.
I can just like a machine.
Let's say I take machine and they use a password, the default password admin.
Wonderful.
So we have selected the credentials as well, we can simply save it one if we can see that.
Now let's go to this can create task.
Click on the new task over here on the dot and.
Let's give a name and scan maybe.
OK, now let's select your target, you can select the most profitable as your target, which you just
created.
You can skip the alerts, should you, if you want, it will cover the cover that in, you know, special
lecture altogether, then.
You get an option of defining your scanner.
Let's keep it default as it is our community lights, we can then come to the scan config.
Now, this is very interesting point.
Scan configures nothing but your scan profile.
We have seen a whole lot of, you know, and which are over network availability test for every menders
like there are more than thousands and thousands of plug ins are I would say the NYPD is getting installed
on open mass similar to the Nessa's.
Nessa's plugin is equivalent to the NYPD of Greenlawn security or open mass.
So what happens is every scan config, every scan config consists of a list of entities.
OK, so just to you know, there are multiple options available like Discovery based Hoh's discovery.
But that's just to you don't know about the host and all this stuff.
Right.
Very basic.
To get more clarity on what all vulnerabilities we have, just like what we do in the real world, really
scanning for and is pretty good.
It's good.
Give it perform the complete scanning at the same time.
It's quick as well if you really want to go very deep inside and cover all the unknowns and possible
unknowns as well, you can go for very deep, ultimate and very deep ASBA for for now we can just select
people full and fast.
This is to keep in mind that we need these scanning to be done a couple of minutes.
All right.
So let's save it.
Once this has been saved, you can see this scan available for you and you can just click on start.
All right.
So let's get started.
And the first phase is the requestor.
Then your START scan will start working.
It might take a couple of minutes to complete the scan and you would see the status on the dashboard
itself about number of tasks we have.
Let's say you have created multiple scans and what are the results?
Do we have, you know, tasked with the most high results for our host and all the star status of your
task as well.
So it's going to take a couple of minutes.
So what we can do is we can post the video for now.
And but it's getting a little bit.
So to be very honest, I mean, it took it took more time than expected.
And the reason is there are really, you know, because it is already infected machine.
So you can definitely expect a whole lot of vulnerabilities into the system.
So you see there are you know, we have found the scanner has found around 163.
One is OK.
And because the numbers are large, you see it's still loading up OK.
And once that is there, once we get to know all the vulnerabilities, we get the details about it,
you know, when we get to see all the details and then to look like most of them are of high risk again.
So let's see if we open any one of them.
Let's say this one lets a second one.
This is Jianyu Bash Bash stacked redirects, also known as redirected back MEMRI corruption vulnerabilities.
OK, let's see if I go there.
It's give me the summary of it.
Product detection results in site detection method affect affected, softer impact solution as well,
and therefore references the reference goes to the CBD just exactly the way we have analyzed, you know,
the nexus as well.
OK, so this is really wonderful.
What do you again, do you know, once you have the all these scan report, you can even, you know,
download the report, you can download it this way.
You can get the do the equipment file and then download it all.
You can even make a PDF file and then download it as well.
So once this is done, you can download the entire report on your system and then you can share it with
the content in the way you want it.
Let's skip it for a while.
Let's go to the other barometers of what is the hottest detail, what are the ports that has been scanned?
So if you remember, we have selected the open very default ports.
These are the most popular ports on which this scanning need to be done.
And in fact, if you remember, we can also make our customizable list, then we can call it under the
desk as a number of applications.
These are the applications which are already prison on the metal exploitable host and you see it actually
scanned.
OK, so this is actually scanning for asking to save the file that we performed earlier.
So this is actually this has actually scanned for all the, you know, application into the metal exploitable.
My school post, great school, Sambor BHB, Zip, Firefox, everything, Kerberos, everything again.
And you can even get to know about the CB information, what other the has been triggered and all this
stuff.
All the good stuff.
OK, so this is all about the you know this does and this gives all the information about, you know,
the report of activity and it is highly customizable as well.
So this is all about scanning, scanning the complete host.
In our case, we have we have selected the metastable.
You can go for any one of them.
And the next lecture will scan will be scanning the, you know, of windows.
So is the Web application.
So everyone will get to see what are the vulnerabilities we come across.