Welcome to part two of this module in this video.
We're going to be taking a look at Linus like almost all of the tools showcased in this class.
Linus comes pre installed on Kali 2.0 as well as most older versions of Kali Linus is an open source
security auditing tool.
It is used by system administrators security professionals and auditors to evaluate the security defenses
of their Linux and Unix based systems.
It runs on the host itself rather than scanning a target remotely so it performs more extensive security
scans than most other vulnerability scanners that are similar to it.
Linus runs on almost any Unix based system.
It even runs on systems like the raspberry pi or even a Cuban app storage device.
Linus is lightweight and easy to use.
Installation is optional.
Just copy it to a system and from the directory where you've saved it.
We need to modify permissions.
C H mod plus X Linus once this is done.
You would just type period forward slash Linus audit system to start the security scan.
However because we're using Cally Linux it is of course easier than this.
We just go to applications
vulnerability analysis and from here we can click on Linus loading it this way will give us the full
list of switches and options for the script the use of which will hopefully be familiar to you.
If you've been going through these modules one by one
if we type Linus ordered
were presented with a few examples of how we can set a target.
We're going to be performing a full system audit since this is the easiest way to show off how the tool
works.
So we're going to type Linus audit system press enter.
This is going to provide us with all kinds of information about the target system because we're running
this in Cali 2.0.
Your results should look similar to mine particularly if you've elected to follow along in this class
using a virtual box installation of Cally.
Linus really comes into its own when you're using it on a system that you have physical access to but
less familiarity with it is useful for auditing a system to identify potential weaknesses to be cleaned
up.
It has a slightly more black hat use than it can be run on a system that a bad actor might wish to penetrate
at a later date
while Linus scans a system it will perform a single target test and output the results of every performed
test to the screen every scan result has to be interpreted by the auditor and checked for what it means
behind most tests it will display either an okay or a warning where the first one is considered an expected
result and the second one is unexpected or denotes a potential problem more vulnerability.
However keep in mind that a result saying okay does not always mean the scan target is correctly configured
or safe in terms of its security or that its use is the best possible practice.
But on the other side of that coin every warning doesn't necessarily mean that something is wrong or
bad since systems and their requirements are different.
However as the auditor performing the tests it is advisable to pay attention to them and check what
influence that test may have on your system or your company policy.
In the case of warnings there are several actions that you can take.
First who can fix the problem which is the most obvious.
Read the log about the technical background and then consult internet sources and documentation to see
for yourself what impact the change might have on your particular system.
Or you can disable that particular test.
This is like the equivalent of a white listing.
Certain types of test results if you wanted to do this you need to open up the scan profile and change
a particular test to test underscore.
Skip underscore always.
However I don't advise doing this unless you have a highly specific reason to do so.
As an example of what such a reason might be.
Maybe you have only one DNS server configured on your workstation a test then shows a warning that reveals
that it expected to working name servers.
In such case you can choose to not get informed about it and disable the test.
Extend the test underscore skip underscore always in your scanning profile with the test number which
can be found in the log file at the end of the line of screen output after every scan.
The auditor should consult the log file and interpret the results.
If tests are displayed as a warning the log file will give the reason why a warning was displayed.
In most cases a suggestion line will also be present to assist in resolving the issue or giving more
information about what the test was expecting and why it was expecting it.
At the end of the testing process Linus will display suggestions and warnings during the auditing process.
Linus will gather these and the results will be grouped together and displayed at the bottom of the
screen output usually warnings and events which really need action.
Suggestions on the other hand could indicate room for improvement.
It's common to find many more suggestions than there are warnings.
But this does not imply that because there are many suggestions and no warnings that his system is properly
secure.
So keep that in mind to determine what has been checked together with the related suggestions or warning
the test identify is displayed on the same line between the brackets when the test is complete.
I'll demonstrate how to open the Linus log file and within it you can search for this identifier
on the subject of identifiers during a security audit.
Linus attempts to assign two identifiers to the system itself they can be compared as fingerprints and
can be used in other tools to link data to an existing system.
The first identifier is named host I.D. and it is 40 characters long.
It typically uses the MAC address of the system as a data point.
The second identifier is host 82.
It is 64 characters long and typically uses a public SS H key which is generated by the test.
I'm going to open a second terminal window
to demonstrate the command necessary to show the host I.D..
Once the test has already run you would type Linus show host I.D. and this will show you these unique
fingerprints
Linus uses a number of plugins which are extensions to the Linus core where normal Linus controls perform
individual tests and share the output plugins will usually gather information.
This information is then collected and processed in bulk.
The big benefit is that it is quicker and more powerful.
For example security intelligence can be applied by collecting data and correlating it on the central
node plugins which do use hooks in existing tests or gathered data for later processing will initialize
during Phase 1 of the audit.
Some tests which are part of the plugin itself will then finish during Phase 2.
After running all of the tests plugins get a last chance to do their job for example pass discovered
elements on the system like a virtual host with Apache plugins which can be used standalone In other
words which have no hooks no input for existing tests etc. can be executed in Phase 1 in these cases
there is no need for a Phase 2 component plugins can be enabled by using the plugin option within the
profile.
It is possible to create custom plugins for Linus or download custom plugins created by others.
As always I am fond of adding.
Be sure to do your due diligence and make sure that the source you download from is trustworthy.
You don't want to get any kind of malware or malfunctioning plugins by accident.
Either way you are advised to add a personal prefix and make the file name for these plugins unique.
This will prevent the file from being overwritten when you update Linus which is likely to happen on
its own whenever you conduct a general app to get update in Cali itself.
For more information about writing your own custom plugins check out the Linus Web site for the professional
penetration testers out there who make frequent use of this tool on a large number of systems.
Linus offers what it calls the Enterprise Edition.
This enterprise edition can be used to upload Linus data via the dash dash upload option for companies
using multiple systems.
The Linus collector is usually the preferred choice.
This specific tool has more capabilities and features which batches data together both the dash dash
upload parameter and the Linus collector are meant to upload data to the central node to use the addition
you would need a license key.
If this interests you please see the website and the Linus documentation for more information.
Keep in mind that these versions of Linus are not free and will require you to have that license key
in order to make use of them for individuals or companies that wish to build their own Linus packages.
There is a Linus dot spec file available building and our PM is very easy due to the low amount of dependencies
that Linus requires such customization is outside of the scope of this particular tutorial though.
But again more detailed information is available online for those of you that have the wish and the
coding skills to pursue that sort of modification.
Now because this is such a straightforward tool but the scans tend to run rather long.
They don't have quite enough to ramble about while it finishes so not wishing to waste your time.
I will make a slight pause in the video recording here and I will resume when this audit scan is complete.
All right now the scan is complete.
I'm going to scroll up for a moment and you can get a sense just by looking at these results of exactly
how detailed this audit was.
Keep in mind that I ran the default options found in the default profile these are customizable.
As I mentioned
and as you can see a great many things were checked for
and when you go through this yourself you can as an exercise select anything that comes up as a warning
and you could look it up to get a sense of what that might mean
basic system information is contained at the top of the test such as for example the operating system
and the program version and the operating system name which for newer versions of Kali is always going
to be Debian but older versions will say a bunch to and so forth
so all the way towards the bottom
want to pass them we can see that there are five warnings no passwords set for single mode.
Can't find any security repository in at C apt source's name server name server IP tables and these
would be things that it has found within Cowley that are concerning and you should be seeing the same
thing.
Although if your version of Carly is different than mine.
This may be a slightly different read out and here are the suggestions that Linus gives.
These will be included in log file.
For example it points out that this version of Linus is outdated and should be upgraded and that's my
fault for not doing that before running this test.
But that's OK install apps get list bugs to display a list of critical bugs prior to each apt installation
that would be a good idea.
Install Deb scan to generate list of vulnerabilities which affect this installation
configured minimum password age and at sea log in depths.
So in other words you can see that there are a great many different possible suggestions to improve
your security and all of these are pretty straightforward like set a password on the grub bootloader
to prevent altering the boot configuration so that's just an idea and it's not something you have to
do but you could.
So anyway that's fairly self explanatory.
I'm going to come back down to the bottom
and here we see that Linus has created two different files the test and debug information.
That's the log file and the report data.
In both cases to access this we simply go to seed forward slash bar sports slash log and I'm going to
use leaf pad.
You can use whatever you would like.
You know open up the Linus log.
And this is what the log file looks like.
And this file is of course searchable
and here we have the test I.D..
In this case performing test I.D. cust 0 5 1 0 or up here performing test I.D. cust 0 2 8 5
and that's the information you would need if you wished to modify Linus as I mentioned during my audit
itself.
And so forth and that pretty much covers the basic usage.
Linus is a good little program to carry around with you want to USP thumb drive or other portable media
as part of your pen testing and auditing tool kit.
It can be used with Cowley It can be used with any other version of Linux any version of UNIX.
It's quite versatile.
Sadly it is not yet usable on windows and that about covers it so I hope this was of use to you.