At last, we are ready to start and assess vulnerability scan.
This is the main page of the Nessus Web interface.
We are in my scan section of scans tab.
At the upper left corner, click new Skåne.
First, Nessa's asks for the scanner.
We have seen them before, so here we can choose the most suitable one for our skin, but in the home
version of Nessus, unfortunately, some scans are disabled.
If you click internal PCI network scan, for example, the application redirects you to the Nessa's
website to buy Nessa's professional.
There are also available scanners like basic network scan or alternatively go to user defined tab and
select your own policy.
This is the policy we defined in the previous lecture, so I chose this.
Now give a name to your scan.
As you can see on the right side of the name Feel, the required fields are identified by Nessa's.
So write a description if you want.
Select a folder for the outputs and define the targets, you can list the host in target field one by
one.
I want to scan my two systems now nine nine eight one three nine is a WASP BBWAA.
And nine nine two zero six as my meds employable system, so if you want a multiple IP addresses.
Just put a comma in between them.
You can also define an IP block or a range.
Just as you remember the unmap lectures or alternatively, if you have a file that contains a list of
the hosts that we also covered earlier, you can have that file using the add file link in the upload
targets field.
So now we're ready to launch the scan at the bottom of the page, select save or click the down arrow
button and select launch to start the scan immediately.
I choose, launch it first, save the scanned and then launched immediately.
So while scanning, let's see some of the parts of Nessus interface.
At the left, you see the folders next to my scans folder, it says that I have one active scan and
in my scans page you see the scan that we just started.
If you click on it, you see the scan details.
There are three tabs here hosts vulnerabilities and history.
When you click on the Vulnerabilities tab, you see the vulnerabilities found during the scan here,
we already have some results.
Now click the hosts tab to turn back.
These are the systems that we defined as targets, WASP, W8 and voidable at the right, you see the
severity levels of the vulnerabilities.
Nessa's classifies vulnerabilities into five levels.
Informational level quickly identifies non vulnerability information, which is, well, nice to know
and separates them from the vulnerability detail, which is need to know.
Right?
Low level identifies the flaws that might help an attacker to better refine his attack, but by itself,
that flaw won't be sufficient for a compromise.
Medium level identifies that some information is leaking from the remote host.
An attacker might be able to read a file he should not have access to high level identifiers of the
attacker, can read arbitrary files on the remote host and or can execute commands on it.
And critical level vulnerabilities are the most important vulnerabilities for us.
These vulnerabilities can be exploited by a tool and in most cases the attacker does not need to make
an extra effort to exploit them.
So let's fast forward the scan.
Now, on the right side of each host row, you can see the status of the scan of that host 100 percent
means the scan of that host is complete.
Did you know you can ping the host sometimes to understand that they're still alive?
And finally, our scan is completed in four minutes, which is a very fast scan for a vulnerability
scan.
Now, let's click the meta voidable to go to the vulnerabilities of that host.
Here are the vulnerabilities of the Métis voidable machine found by this scam.
Please note that there might be other vulnerabilities that cannot be found by Nessus with a policy that
we used.
The vulnerabilities are ordered by severity levels, by default, and I think that's a good idea.
The vulnerabilities in a critical severity level are the most important ones for us again.
So click on a vulnerability to see the details of it.
So here we have the name of the vulnerability, a brief description.
A solution method and the links to learn more about it, and last, the host and the port where the
vulnerability lives at the right side of the screen, you see some additional and important information
about the vulnerability over this particular vulnerability.
Nessus says that we can exploit it using core impact, which is a commercial and very powerful exploitation
tool.
And here are the scores of this vulnerability, 10 dot zero is perfect for us.
So quick, back to vulnerabilities, you go back to the list of the vulnerabilities here, there is
another vulnerability which says the Vincey server is running on the host and its password is password.
If that's true and if there's no additional measure to protect the host, we can access that host very
easily.
Show you.
Let's test it, go to the terminal screen and run the BNC viewer by typing X Vincey viewer and hit enter.
If you don't have the fancy viewer installed on your Colly type apte dash get install x vincey viewer
and hit enter.
Take the IP address of Métis Voidable as the Vincey server and hit enter.
And now type password as the password and hit enter again.
And voila, we are in the system.
I use the WAMI Linux command to learn the user that I've caught and you name Dash A to learn the operating
system and the kernel details if config to see the information about the network interfaces, etc..
Now, type R.M. Dash, R.F. Slash, no, no, no, no, just kidding, don't don't do that.
Don't.