Welcome to the video scanning with open Vohs in this video we will add additional users to the open
as counsel create and run our first basic scan and review reporting options.
In our last video we walked through installing the open vase vulnerability scanner and now we're ready
to log in and actually conduct a scan before we do that though.
I wanted to show you how to fix an issue you might run into after you've rebooted your Kalli box.
What I'll do on my system here is try to visit t s colon slash slash local host colon 9 3 9 2 which
is what open valves listens on and see that we are unable to connect.
That's because the open avows software doesn't start automatically upon each pute of Kalli.
So let's drop to a command line and then issue the open vires TAC start command.
We'll give that a couple of seconds to finish and then refresh the page.
It looks like the interface is now up so we can log in as admin.
And if you remember from the last video the password that's generated is actually pretty long and narly.
We'll talk about how to change that in a moment.
But for now I will kept the file with a password on my desktop and paste it into the open interface
will then be brought into the main open vase Council where we've got lots of menus and options to pick
from.
Now if you really want to get a full primer of open vase I encourage you to read through the full documentation
at open vised.
But for now let's jump in and look at a few basic configurations.
If we're going to be security conscious we probably want to set up an additional user in the open bus
system that just has basic permissions so let's go click under the administration menu and click users.
If you're like me you might find the open Avaaz interface a little confusing in that you'll need to
hover over various icons to figure out what they do.
At first glance of this page for example you might not think the currently logged in user has rights
to add a new user to the system but the function to actually create a new user is over here on the left
side and represented by a star.
So we'll click that I'm just going to create a simple user called Brian Ptak gooey to indicate we created
it here in the user interface and give it a simple password.
We can see that the user has added And if we wanted more users we could keep clicking the star icon
and punching them in manually.
However it may be more efficient especially if you're going to add a bunch of users to do some of these
operations at the command line.
For instance if I want to do a quick check of which open VOZ users are on the system I can use the open
Avaaz M.D command along with the tac tac get TAC users flag and if we want to create a brand new user
we can use the open vase M.D command again with the tech tech create tech user equals and then the user
name I want to create you'll see that just like when we created the initial admin user open vised creates
an extremely secure password by default.
Let's do a get users one more time to verify the Brian Council user is there.
And now because that password is a little too secure even for my tastes.
Let's change that by using the open vase M.D command again and this time using the tac tac user equals
and then the Brian Council user followed by tac tac new tack password in equal sign and then the new
password that I want to use back at the open VADs web Council let's refresh the Googie and we can see
that the new account is there.
Now we can log out and log in as one of the new Brian users but let's just keep moving forward and do
a basic scan.
We can start that by clicking scans and then dashboard.
We don't have any scan results yet so I'll go back under the scans menu and click tasks once I do that
we'll see a pop up letting us know that the easiest way to get started is by using the wizard icon from
the top left of the screen.
So let's click that and click taske wizard.
This will pop up a new window that allows us to quickly scan an IP address and by using this wizard
we can see that open vase will create a new target in our database.
It will set up the scanning task and also kick it off.
So sure let's just scan the localhost and click Start scan
for the interest of time I'm going to speed this up.
But if you keep an eye on the status bar you can watch your scan progress until it ultimately finishes.
Once the scan is done we can click on the scanned name and get some details about the type of scan we
did how long it took.
And then also see a link to a report with more information.
Which we can click into now.
Now unfortunately the results here are a little boring as there were no high medium or low vulnerabilities
found.
However if there were findings worth looking at we could just click into the skin name again to get
the details.
In this case we can see that only log entries showed up in the scan and those get filtered out by default.
But in the next video we'll look at scanning a larger range of hosts with more interesting results.
In our next video we'll look at scanning multiple targets schedule and tune our scans and also set up
alerts.