Welcome to the video advanced scanning with open Vohs in this video we will import a list of targets
such as that from an end map scan will tune the scan to make it as efficient as possible.
We'll scan the target with credentials to get a more complete picture of the vulnerabilities that may
lie within the host and we'll schedule scans to ease the load on the network during peak hours.
In the last video we talked about how easy it was to do a point and shoot scan of an IP on your network
using open bus.
But there's a good chance you are going to want to scan multiple hosts or subnets.
You also may have noticed that in the last video we performed our scan in an authenticated fashion.
In other words I didn't try to connect to any hosts using valid credentials and thus I can only see
a surface level picture of the vulnerabilities that might lie inside.
So it's important that we know how to scan multiple hosts with open files and also know how to pass
credentials to these hosts to get the most value out of our scans as possible.
Now I prefer to use open Avaaz primarily as a vulnerability scanner and not for the host discovery phase
of a project.
So I'm going to use one of the nmap scans we talked about in the past video.
First let's cap a file called subnet CTX T which contains the networks.
I want to scan then I'm going to use and map plus the TAC s and flag which essentially does a ping sweep
and I'll add the tech O.G. flag to create a graspable output and then the rest of the command essentially
takes the result of our scan identifies any hosts that return a ping and outputs them to a nice clean
list one IP per line to a file called libe hosts Dotti XTi
let's catch this file as well to see what's in it.
And it looks like we have our target list ready to go.
Next I want to give open Avaaz a set of credentials so that if it scans any Windows machines in my environment
it will connect with those credentials.
Again like I said earlier doing this type of authenticated scan will yield greater results than what
we'd see in an uncredentialed scan.
So let's go to the configuration menu and click credentials.
Then I'll hit this star over on the left side of the screen to enter a new credential.
And then I'll give this set of credentials a name a description and a username and password itself.
I'll click Create and then we can see the credentials in our little credential vault of sorts here.
Now we'll want to get our targets ready to receive a credentialed scan.
So let's go under configuration menu again and click targets will hit the star icon again to create
a new target.
And then here all give the target list a name and comment.
Then I'll click to browse and point to the Live hosts we created earlier with our map scan.
Under the live test you'll see we've got several choices we can pick from to make open vised discover
Live hosts on the network now because I've already done this ahead of time with any map I'm just going
to click.
Consider a live and then under the credentials for authenticated checks you'll see we can provide S-sh
SMB or V.M. where yes XCI credentials.
I'm going to click the dropdown next to SNB and pick Windows which is what I nicknamed my windows credentials
set.
We should be good to go here so all click Create and we'll see this target list pop up on our screen.
Now before we actually kick the scan off we might want to set up an alert so that we get an e-mail when
the scan completes.
So let's hit the configuration menu again and click alerts.
I'll give mine an appropriate name and comment and I'll choose to have the scanned completion be the
event that triggers the alert then I'll fill in my e-mail to and from address and click Create.
OK so I should be set to kick the scanner off.
But let's say we wanted to ease the load on the network.
And so rather than run this now during business hours we want to run it when nobody's in the office.
So let's go to configuration and schedules and then choose to create a new schedule and all set up my
scans so that it runs just before midnight.
In my time zone which is Central will hit create and then we should be ready to pull the trigger on
this scan.
So let's go under the scans menu and click tasks will choose to start a new task.
We will give it a name a comment and we'll also choose to be alerted via the alert that we just set
up and we'll also have this scan follow the after hours schedule.
We built called after hours and that's it.
We should be set now in the interest of time I'm not going to wait until 11:45 to watch the scan kickoff.
So I will just trigger it by clicking the arrow now.
I found that sometimes scans will seem to be completely frozen and the percentage bar won't move for
a long time.
If you want to get it behind the scenes look at what the scanner is actually doing.
You can drop to a terminal and then do a tail of the open vase M.D logfile shown at the path here.
And add a TAC F at the end as a reminder the tail command with a TAC F at the end essentially means
show me a live view of what is at the end of this file.
And if new data is written to the file show me that as well.
And by watching this log for a bit we can see that the scan actually has flipped to a Donne's status.
But the web GUI is not reflecting that.
However if we just do a refresh of the page we'll see that the scan now shows 100 percent completion.
And just like with our last scan we can now drill several levels deep into the results of the scan and
learn more about each discovered vulnerability.
We'll also see a nice write up with recommendations on what remediation we need to take if necessary
in our next video.
We'll look at additional Kalli tools we can leverage to scan for vulnerabilities in web applications.