So now I'm going to check the Nessa's service and started.
OK, so open your browser now and type HTTP Escalon, Celeste Colly, Colen eight eight three four.
And then this will take you to the NSA login screen.
So in the beginning, you may see an initialization screen like this one.
So just down to your credentials and hit the Sinon button.
OK, so now this is the Nessa's homepage.
It has a pretty clear and clean interface.
So what I'm going to do is quickly add a folder for my scans and name it PWI MSF.
So create the folder and let's go into the folder.
OK, so now you have two options here.
You can either create a scan directly.
Or you can create a policy and then use this policy for a particular scam.
Me, I always create policies because then I can use them in every penetration test that I do.
So I would advise you to do the same, just follow along.
So even now, I'm going to show you how to create a policy.
So click here to start.
Right, so now these are the predefined policies.
Now, for your purpose, you can choose one of them.
But also, you have the option to start a custom policy.
So over here on the upper left corner, there's an advanced scan, so click here.
All right, so let's give it a name and description, and that's going to be your first scan.
So Nessa's provides you an ability to share your policy or scan with other users.
So if you want under the permission tab, select can use as an option.
Under the discovery menu.
You'll find how to discover hosts and services, and you can also can figure out how to scan the ports
on the target.
And there's really nothing to change here.
Assessment menu, it provides extra assessment configuration.
Now, here under brute force segment, I want you to check this box to not try after a successful launch
in.
All right, so you have Web applications in our lab open in.
I won't change anything under Windows and Malware segment.
Now, you can specialize in reports, but I think it doesn't allow much more than that, this might
be, if there is one, a negative side of Nessa's.
And the advanced menu.
She now.
I think I've said this before, but being stealthy is important, so you've got to check here to randomly
scan targets.
And also check here to prevent network congestion.
And under the credentials tab, Nessus gives you the opportunity to scan targets with custom discovered
credentials.
Nessus will perform more tests on the targets if valid credentials are given.
And you can also add ASH is as well as some other service accounts.
So earlier, we have discovered how to use the vagrant username and password.
So that's what I'm going to use.
Compliance tab.
Not going to change anything here.
This this could be a good benefit for you when you perform a vulnerability assessment.
Now, here there are many compliance checklists, you can choose a bunch of them and run a scan, but
for now I don't need that.
And here's a plug instead.
So this is actually takes its power from plug ins, every plug in performs a particular task and the
Nessa's team divides plug ins into families.
So, for example, the denial of service plug ins resides under this category.
Now, you also have to be careful to check the plug ins, because every unrelated plug in will create
congestion in the network and that prevents you from being stealthy.
And also some plug ins could very well crash the system.
Sorry, now I am going to quickly uncheck unrelated plug in families.
Not going to touch plug ins itself.
But you can be that specific.
So finally, save the policy.
Okeydoke.
So now you need to create a scan that's going to use his policy.
So go up here to the top menu scan's.
And here are the predefine scanned, but if you want to use your policy like I do.
Follow me and go to the user defined tab.
And click your policy.
Now this green comes up, so name your skin and give it a description.
And I'm going to choose the folder P wms f and now you can add targets.
So, of course, we're going to use the both the Matus voidable two and three IP addresses.
All right, so let's save the scan.
Now, let's check the scan here and from that menu, just launch it or reconfigure it.
I'm going to launch it.
OK, so now you can watch the progress and examine what NASA's finds.
Scans are going to take some time, so.
I'll just let it finish up and I'll get right back to you.