At last we are ready to start at Nessus vulnerability scan.
This is the main page of the Nessus web interface.
We are in my scan section of scans tab. At the upper left corner
click new scan. First Nessus asks for the scanner.
We have seen them before.
So here we can choose the most suitable one for our scan.
But in the home version of Nessus, unfortunately, some scans are disabled.
If you click internal PCI network scan for example the application redirects you to the Nessus website
to buy Nessus Professional.
There are also available scanners like basic network scan or alternatively go to "User Defined" tab and
select your own policy.
This is the policy we defined in the previous lectures.
So I chose this.
Now give a name to your scan as you can see on the right side of the Name field. The required fields
are identified by Nessus. Write a description, if you want.
Select the folder for the outputs and define the target.
You can list the hosts in "Targets" field one by one.
I want to scan my two systems now, 99.139 is OWASP BWA and 99.206 is my Metasploitable system.
So if you want a multiple IP addresses just put a comma in between them.
You can also define an IP block or a range just as you remember in the Nmap lectures.
Or alternatively if you have a file that contains a list of the hosts that we also covered earlier you
can add that file using the "Add File" link in the "Upload Targets" for you.
So now we're ready to launch the scan. At the bottom of the page,
select "Save" or click the down arrow button and select "Launch" to start the scan immediately.
I choose "Launch", it first saved the scanned and then launched immediately.
So while scanning, Lets see some of the parts of Nessus interface. At the left you see the folders next
to "My Scans" folder.
It says that I have one active scan. And in "My Scans" page.
You see the scan that we just started.
If you click on it you see the scan details.
There are three tabs here, "Host", "Vulnerabilities" and "History".
When you click on the "Vulnerabilities" tab you see the vulnerabilities found during the scan.
Here we already have some results.
Now click the "Hosts" tab to turn back.
These are the systems that we defined as targets:
OWASP BWA and Metasploitable.
At the right, you see the severity levels of the vulnerabilities. Nessus classifies vulnerabilities into 5 levels.
Informational level quickly identifies non-­vulnerability information, which is “nice to know” and
separates them from the vulnerability detail which is need to know.
Low level identifies the flaws that might help an attacker to better refine his attack, but by itself that flaw won't be sufficient for a compromise.
Medium level identifies it
some information is leaking from the remote host.
An attacker might be able to read a file he should not have access to. High level identifies that the
attacker can read arbitrary files on the remote host and or can execute commands on it and critical
level vulnerabilities are most important vulnerabilities for us. These vulnerabilities can be exploited
by a tool and in most cases the attacker does not need to make an extra effort to exploit them.
So let's fast forward scan,
now on the right side of each host role you can see the status of the scan of that host.
100% percent means the scan of that host is complete.
You can ping the host sometimes to understand that they're still alive.
And finally our scan is completed in 4 minutes which is a very fast scan for a vulnerability scan.
Now let's click the Metasploitable to go to the vulnerabilities of that host. Here are the vulnerabilities
of the Metasploitable machine found by this scan.
Please note that, there might be other vulnerabilities that cannot be found by Nessus with the policy
that we used.
The vulnerabilities are ordered by severity levels by default.
And I think that's a good idea.
The vulnerabilities in a critical severity level are the most important ones for us again.
So click on a vulnerability to see the details of it.
So here we have the name of the vulnerability.
A brief description, a solution method and the links to learn more about it.
And last the host and the port where the vulnerability lives. At the right side of the screen you see
some additional and important information about the vulnerability.
So for this particular vulnerability Nessus says if we can exploit it using Core impact which is a commercial,
and very powerful exploitation tool. And here the scores of this vulnerability 10.0 is perfect for us.
So click "Back back to vulnerabilities"
to go back to the list of the vulnerabilities. Here there is another vulnerability which says the VNC
server is running on the host and it's password is "password".
If that's true and if there's no additional measure to protect the host. We can access that host very
easily.
I'll show you.
Let's test it.
Go to the terminal screen and run the VNC viewer by typing "xvncviewer" and hit enter.
If you don't have VNC viewer installed on your Kali. Type “apt­get install xvncviewer” and hit
enter
Type the IP address of Metasploitable as the VNC server, and hit enter and now type "password" as the password
and hit enter again and voila we are in the system.
I use the "whoami" Linux command to learn the user that I've caught.
And "uname -­a" to learn the operating system and the kernel details. "ifconfig" to see the information
about the network interfaces etc..
Now, type "rm ­rf /".
No no no no.
Just kidding.
Don't don't do that.
Don't.