Let us end the vulnerability assessment section with launching a scan using Nessus in the last previous
two lectures, we saw how to download and configure nurses.
And in the last lecture, you saw how to create a policy.
In this lecture, you will see how to create a network scan and you make sure we are scanning the websites.
You know, make sure you turn off the browsing protection if you have any antivirus, because while
scanning nurses send packets to the antivirus, to the website and antivirus niebler kinesis from visiting
the website.
And then there is no use so quickly logging into the nurses and let us get started with the scan.
So as you can see, go to all scans, could create a new scan.
And then you can go to user defined and then we can find our policy.
Let's enter the name of the scan, which we are going to do, I will give it to the mosque and name
and if you want to get a good description, but that's not really required by practicing.
Again, a warning.
Please do not use Nessus to scan some random websites as it is out of bounds.
And you may face legal action for doing this because all these scanners send packets to the target machine.
And if the target machine has a firewall, they may detect from where the packets are coming and you
may get compromised.
So without having any prior permission, do not use such scans and also the other tools which are going
to demonstrate in future videos.
Now it is time to put the target so we will enter the target IP address of 30 year old hacker dot com
website.
We know how to find out the target IP address of certified hacker.
We will use or assign the tools or website for, you know.
Hacking, so in this tutorial, we are not going to use certified hacker, but we will use a different
website.
So these 15 vulnerable websites are legally used to hacking practice skills.
So let's scroll down and let's pick one of them.
So I will go with the let's say.
Matilda is already installed.
Uh, you can go to the website, so I will just use a demo test pilot website so you can just Google
and this is a little mutual something there.
But this website is only meant for hacking, so you can legally use it.
So I will use the demo to test fired minute website.
Now I want the IP address of this website.
So how will I find out the IP address?
We have learned how to gather information and we have also learned how to use the authentic framework.
So we'll go to Assante framework and I will just go to IP address section IP four years IP before and
then I will pick one of them I will go with.
The first one is lookup and then it just entered the IP address.
I will go and you go.
Exclusive domain and click search in the moment, you will get the results Vola.
We have got the IP address sixty five point sixty one point one thirty seven point one one seven.
Sixty five point sixty one.
Point one thirty seven point one one seven.
And then click save to scan so I can see a scan has been saved and we now launch the scan, so depending
upon the target Web site how long it is, the scan will take place around one and a half hour to one
hour for complete scan to get completed.
But also while scanning, we can see the vulnerabilities and the hosts.
So let us wait till the scan gets completed.
As you can see, the scan is still going and I guess we have found something we have found.
So you can see these are the five types of vulnerabilities, critical, high, medium, low and just
information.
So you can see the NSA scanner is using a map half board scanner to scan the target website for 443.
PXP was found to be open for eight years, found to be open.
Port 88, that is HTP was also found to be open.
That is headed back to one liberties and let's wait for something more interesting.
Now, we have got something interesting, we have got eight medium one tragedies and too low and then
almaty's.
Around 94 percent of the scan is completed.
Let's go to vulnerabilities, let's see the mixed.
Yes, the first one says SSL cannot be trusted, which is obvious because the site isn't having a secure
connection.
It is not GPS, it's at GDP.
So if you can click on the so you can see it's not secure, which means it is not using HDD and therefore
the SSL certificate is not configured.
Now, if you click on the vulnerability, you can see the description.
You can also see the solution and you can see what is the one that would be exactly doing.
So, you know, it's a great tool, Nessus.
It gives you references.
It gives batching assistance.
It also gives their description about the realities.
So this is one of the main advantage of using Anissa's.
So make sure you read everything before generating reports.
As we have discussed, there are two types of reports.
This type of description is required in the upper management level type of report.
Again, as a security expert, you shouldn't fully rely on Nessa's or any other scanning tool because
they are not 100 percent accurate.
Uh, so as you can see on the screen, we have good solution references, output boards which are scanned,
the CSV information.
And, you know, if you actually go to that, uh, we can actually see that when the rabbit is present
in the common vulnerability database and you can see this is the description of the vulnerability.
This is the CVS version, it's law based score, and these are the links, the resources that you should
probably go after.
And that is why our security experts always prefer Nessus, because it is a comprehensive tool and it
is constant under development.
One main thing we're scanning is you have to be patient, you won't get results in two to three minutes.
We have to wait until at least for two hours to get a complete scan result.
So as you can see, the server is using Apache and it reveals a lot of information, basically manual
penetration testing is also needed to verify the results and then only you present the results.
So this is how Nessa's is used for temporary purposes.
I will stop the scan or just let it go, but make sure you wait till the scan is complete.