Welcome to part one of this module
to kick off the section on vulnerability analysis.
We're going to be starting off by taking a look at Nick toe
Nick toe is an open source GPL web server scanner which performs comprehensive tests against web servers
for multiple items including over six thousand seven hundred potentially dangerous files and programs
checks for outdated versions of over twelve hundred and fifty servers and versions specific problems
and over two hundred and seventy servers.
It also checks for server configuration items such as the presence of multiple index files each TTP
server options and will attempt to identify installed web servers and software scanned items and plugins
are frequently updated and can be updated automatically Nick to is not designed as a stealthy tool.
It will test a web server in the quickest time possible and is obvious in log files or to an ISP or
IBS so if this is a concern please see the modules pertaining to the subject of anonymity.
For more information not every check that Nick two runs is a security problem.
Although most are there are some items that are classified as info only type checks that look for things
that may not have a security flaw.
But the webmaster or security engineer may not know are present on the server.
These items are usually marked appropriately in the information that it prints.
There are also some checks for unknown items which have been scanned for in long files.
NICTA comes prepackaged with Kelly 2.0 and is located in applications near vulnerability analysis.
Nick Toh can also be opened from the terminal window by typing Toh and I'm going to do it this way so
as to bring up the Help options
for this we simply type Nick to dash dash or TAC tack help.
I do not wish to be unkind when I say this.
However it is a fact that most of the time the system administrators who setup a particular website
or service don't necessarily know what they're doing.
This comes in the form of leaving subdomains wide open for people to find and leverage but it also takes
the shape of small random server mis configurations of ports or services.
NICK too is very good at finding these sorts of things.
I understand that there are some who feel that WordPress is perhaps better.
However WordPress scan is limited to sites that use WordPress whereas Nick too can be used on just about
anything.
This tool is well supported and kept up to date by a very active user base.
We'll be using Nick toe to look for any vulnerabilities on a target Web site for demonstration purposes.
I have once again set up a virtual machine running met a split bill with Web services which is sure
to have a great many vulnerabilities to show off as always.
Never run this program against any Web site or target that you do not personally own or have written
permission to pen test.
Otherwise you could be breaking the law.
So looking over the menu let's look at once some of these switches do right from the beginning we can
see that it is sorted really well.
Some more experienced students might be wondering at this point why someone would use Nick toe over
WordPress scans since they essentially do the same thing now.
Like I said the reason is that while WordPress is very good against WordPress sites Nick too excels
because it works on any Web site or web server.
Literally any This makes it a far more versatile tool.
So to start out with I'm going to look at some of the more important options we're going to highlight
D.B. check all of these are called switches.
By the way and this one will let you take a look at what some of these commands do.
This command checks for database errors as well as other key files syntax errors format allows you to
select what format you would like your results saved in when you use the dash o switch.
For example a text file or each team it'll help is obviously self-explanatory.
Host is your target data.
The program will require you to specify an IP address a web address or a domain.
This is what NICTA will be scanning against
list plugins will show all of the currently available plugins.
These can be updated either directly from within the tool or by updating the tool itself.
When you conduct system updates
output will simply write the output of your scans to a file no SSL will disable SSL fairly self-explanatory
port
simply specifies which port we will be using.
Now you can change this if you want to.
In this video you'll see me scan port 80 just for simplicity's sake but more involved or specific tests
may call for other ports SSL will force SSL mode which is not that important.
You won't come across this very often but it is provided in the rare instances when you have a need
for it update is also self-explanatory as I mentioned.
You can use this command to update the database and plugins to the latest versions.
I suggest running this once a month although you should be conducting a regular app to get updates for
your operating system anyway which should include the latest version of this tool making this particular
command somewhat unnecessary.
All right let's get started with the commands that we are going to be using.
I'm going to clear this out for a fresh terminal window and here we go will begin by typing Nick to
and then use the dash 8 switch to specify our host followed by our target information which in this
case is going to be for my met a split able machine and I have running on my network.
Again you could specify a website address or even a domain for that matter.
Just remember that this is not a stealthy tool and scanning targets without permission can get you into
trouble.
Gash P will specify our port and as I mentioned leaves port 80 press enter and see what the tool comes
back with
right away.
It's going to detect the web server which is Apache 2.0 2.8 we can already see that the cross site header
is not defined as a very very big vulnerability that could be exploited which will be demonstrated in
the relevant modules such as a burp sweet and met a split.
Of course the problem with scanning and met hospitable machine is we're going to get back more possible
attack vectors than we really know what to do with
and we can just see there they're piling up
I may make a small cut to the recording as this may take a few minutes
okay.
So this is a lot of information.
We're gonna scroll up past all the gibberish
so of course as I said the problem with scanning a Met is supportable machine as we're going to get
back so much stuff
and as I'm fond of saying your personal mileage will vary depending on the security practices of your
target.
However the key point to take away here is that Nick toe is exceedingly thorough and all but it checks
I'd like to try to keep each of these modules self-contained and not jump ahead.
But this really is going to make your eyes widen when we get to the point of showing how to exploit
all of these various vulnerabilities
so as I said this is a lot of information.
But let's look at another command which is the output command.
So we want to be able to record the results of our scan unlike other tools Nick toe does not let us
specify a file path.
Instead we're going to need to switch to the directory that we want the output to be written to.
So in this case I'm going to keep things simple and switch to the desktop
I'll clear the terminal
and now we'll use the same command as before which is going to be Nick to dash each for host.
We'll give it the IP address of our virtual machine for met a split able and you would give whatever
your target IP is your Web site or your domain will specify P. 80 for port 80
and now we're going to add the switch dash 0 or TAC 0 to specify that we're using the output command
and we'll give it a file name let's call it to these old s I suppose
and we'll specify the file type by typing dash capital F and we'll get the file type.
In this case I think I'll just make it a text file.
You could do anything you want for example.
Well okay let's see
we could do anything we wanted here such as for example H TTP if we wanted to include it for an online
report we'll hit enter
and it's going to run the scan we just saw only this time it's going to be writing the scan results
quietly in the background to the file that we specified.
Once the process is complete the data will be saved to our desktop.
Just give it a few seconds to complete the scan and as we can see as it goes here it's just loading
up those vulnerabilities
as before I'll make a short pause to this recording for time saving purposes all right the scan is finished
I'm going to minimize Nick to Ben here we go our Nick to scan results I'm going to go ahead and open
this file and there we have it the entire output
and again we'll be looking at how to use these various vulnerabilities further down the line.
But the important thing for now is to simply understand what we've got and how to gather this sort of
information as this will be fundamental as we progress.
These are the basics the foundation of penetration testing and ethical hacking.
Knowledge is power and with even a single potential vulnerability in hand even if you don't know how
to use it you have a place to begin researching online to see how others have used it.
So as you can see.
So as you can see we have a nicely created report here.
And what I recommend doing is placing all of your reports into a folder that pertains to whatever target
or penetration test you're running to keep things organized
and all right.
That will about do it for Nick tell an excellent and versatile tool and compared to some of the more
switch having applications out there it really is quite simple to use.
Thank you.