Instructor: In this lesson, I'm going to show you 2 2
how you can conduct scanning using a tool like Nessus. 3 3
Now, as we go through this lesson, 4 4
I'm going to be going through my own sample lab 5 5
and be able to do some scans with Nessus 6 6
across these different devices. 7 7
I'm doing these both individually and as a group. 8 8
Now what you're seeing here on the screen 9 9
is a visual representation of my current lab network. 10 10
Over on the left side, 11 11
you'll see that at IP address 192.168.1.116. 12 12
That is a Mac machine and that's actually my desktop 13 13
that I'm using to record this video 14 14
to demonstrate how to use Nessus. 15 15
In addition to that, I also have a Kali Linux machine, 16 16
which is what I'm logged into now as a virtual machine. 17 17
All of the things that are starting with 18 18
192.168.150, dot something are part of my virtual network 19 19
in the lab environment, 20 20
whereas the Mac machine is part of my office network, 21 21
which is why it has a different IP address 22 22
starting with 192.168.1, dot something. 23 23
Now as you look at the circle, 24 24
you'll see that there are different devices 25 25
that are connected to this virtual network, 26 26
including a Windows 11 machine at 192.168.150.138. 27 27
My local host, which is also my Kali Linux machine, 28 28
which is 192.168.150.129, 29 29
my Metasploitable 2 virtual machine, 30 30
that is going to be a very vulnerable client 31 31
for us to find a lot of issues and vulnerabilities with, 32 32
and that's at 192.168.150.136, 33 33
and an a Ubuntu Linux machine 34 34
that is located at 192.168.150.137. 35 35
Now the Windows 11 machine, the Ubuntu machine 36 36
and the Kali Linux machine should all be relatively secure 37 37
because they've just been installed 38 38
and they've been updated with the latest security patches. 39 39
The Metasploitable 2 machine, on the other hand, 40 40
will probably find a lot of vulnerabilities 41 41
because it is a vulnerable machine by default, 42 42
and we use this to be able to practice 43 43
our penetration testing skills 44 44
or our cybersecurity analyst skills 45 45
by finding those vulnerabilities 46 46
and then trying to patch them, rescanning the machine 47 47
and then seeing if we've solved those vulnerabilities 48 48
in the network. 49 49
Alright, now that we have a basic understanding 50 50
of the network that we're going to be using, 51 51
let's go ahead and move into looking at Nessus. 52 52
Alright, here you can see the Tenable website 53 53
and if you go to tenable.com, 54 54
you can search for the Nessus Essentials tool. 55 55
This is a free tool that used to be called Nessus home 56 56
and it allows you to scan your environment, 57 57
including all of your network up to 16 IP addresses 58 58
per scanner, using the same high speed. in-depth assessments 59 59
that you'd get with the professional version of Nessus. 60 60
As a cybersecurity analyst, 61 61
you need to get comfortable using vulnerability scanners 62 62
like Nessus and OpenVOS, 63 63
because depending on where you work, 64 64
you'll either be using Nessus or OpenVOS or QualysGuard 65 65
or some other vulnerability scanner, 66 66
but most of them work pretty much the same way. 67 67
So in this lesson we're going to use ESUs Essentials, 68 68
because it is something that is free to use 69 69
and you can download it and do this 70 70
on your own home network as well 71 71
to see what vulnerabilities exist there. 72 72
To do that, simply go to this webpage, 73 73
enter in your first name, last name, and email address. 74 74
They'll take you to the download page 75 75
and they'll email you an activation code 76 76
with a license key that is good for about five years 77 77
for you to be able to start playing with Nessus 78 78
and getting used to how it works. 79 79
Once you have Nessus installed on your computer, 80 80
it's going to run as a program in the background 81 81
and essentially starts up a web server 82 82
that you can access on your local machine. 83 83
To access this, you'll go to local host: 8834, 84 84
which is Port 8834 on your local host, 85 85
which is the machine you're accessing it from. 86 86
In my case, that's my Kali Linux machine. 87 87
Once you're there, you're going to walk through 88 88
the setup wizard and then you'll create an account. 89 89
In my case, I've already done that, 90 90
so I'm just going to go ahead and log in using my account, 91 91
which is Dion Training. 92 92
Once you've done that, 93 93
you'll be brought into the My scan screen. 94 94
Now the first time you do this, 95 95
you're going to have nothing listed here 96 96
because it is going to be a blank scan 97 97
because you haven't done anything with Nessus yet, 98 98
because it's a brand new install. 99 99
In my case, I've already done a couple of these scans for us 100 100
so that way, we'll be able to look at the results 101 101
without having to wait a long time for them to come back 102 102
from doing the scans. 103 103
These scans can take a really long time 104 104
depending on the size of your network. 105 105
Even for a really small lab environment like the one I have, 106 106
I have that top scan, which is a basic scan 107 107
of my entire network that has been running 108 108
for about 45 minutes at this point. 109 109
Now, in order to use Nessus, 110 110
you need to create a scan profile 111 111
and you can see I have several of them already created here. 112 112
I'm going to walk you through how you can create 113 113
your own scan profile and then we'll take a look at 114 114
some of the results from my scanning profiles 115 115
that have already been run. 116 116
To do this, simply click new scan at the top right corner 117 117
of your screen, and then from here, 118 118
you'll see all the different types of scanners you have, 119 119
including discovery scanners to be able to figure out 120 120
what hosts are on the network, vulnerability scanners 121 121
that will target specific vulnerabilities, 122 122
or we also have compliance scans. 123 123
Now, when you're using Nessus Essentials, 124 124
compliance scans are not something 125 125
you're going to be able to use. 126 126
These compliance scans are things like 127 127
PCI DSS, internal network scans 128 128
or offline configuration audits 129 129
or the PCI quarterly external scans that are required 130 130
once a quarter if your organization takes credit cards 131 131
as part of their business model. 132 132
All these are things that are included 133 133
with the Nessus professional and expert versions, 134 134
but in the home version, which is Nessus Essentials, 135 135
these are actually blocked out and you have to pay 136 136
to get the access to those. 137 137
For most of us though, 138 138
if we're doing this in our home network, 139 139
those don't actually matter that much 140 140
because you're probably not processing credit cards 141 141
on your home computer and instead you're more focused 142 142
on the things that are above, 143 143
which are the different vulnerabilities 144 144
or the discovery scan. 145 145
Now if you're looking at these different vulnerabilities, 146 146
you'll notice these are targeted 147 147
for specific groups of vulnerabilities. 148 148
For example, you can see in the middle of my screen 149 149
there's one called the WannaCry ransomware. 150 150
This was really popular back in 2017 151 151
and affected all Windows machines at the time. 152 152
When something like that comes out, 153 153
a lot of times Nessus will create 154 154
a specific scan vulnerability for that one plugin. 155 155
This way you can quickly look across your entire network 156 156
even if you have a hundred or a thousand machines 157 157
and check just for that one vulnerability. 158 158
That's the reason why you're seeing 159 159
these vulnerabilities listed here, 160 160
because these are the ones that were really, 161 161
really important to look for. 162 162
Things like Spectra and Meltdown and WannaCry and Ripple 20 163 163
and things like that. 164 164
So for our cases we're not going to look at 165 165
just a single vulnerability, 166 166
but we want to look at what vulnerabilities exist 167 167
across the entire network so we can get a better idea 168 168
of exactly what vulnerabilities exist right now 169 169
in our network and create a baseline 170 170
for us to use as we move forward. 171 171
To do this, we're going to do a basic scan. 172 172
So I'm just going to click over here 173 173
and do a basic network scan, 174 174
which is a full system scan suitable for any host, 175 175
and once I click on that, it's going to have me give it a name. 176 176
In my case, I'm just going to call it Network scan 177 177
and then I'm going to give it a description. 178 178
Now this is really helpful because these scans 179 179
are ones that you're going to create 180 180
and then use week after week and month after month, 181 181
and so six months from now you might forget 182 182
why did you call this Network scan? 183 183
So in my case I'm going to say "A lab demonstration 184 184
of using Nessus as a vulnerability scanner." 185 185
All right? And then we're going to save it into a folder. 186 186
We can do it in the My scans folder, 187 187
which you see in the top left corner, 188 188
or you have the All scans folder. 189 189
If I wanted to create a new folder, I can do that as well, 190 190
but for our purposes, the My scan folder 191 191
is going to be just fine, 192 192
and then we're going to list out our targets. 193 193
Now, when you're listing out your targets, 194 194
you can do this based on domain names like diontraining.com 195 195
or by using IP addresses. 196 196
For example, if you're doing your internal local network, 197 197
you're probably going to have to use IP addresses, 198 198
because you probably don't have a domain name 199 199
associated with each and every host on your network. 200 200
Now in my case, I'm using the 192.168.150.0/24 network. 201 201
Now if I didn't know any of my hosts on that network, 202 202
I can scan the entire subnet of 256 hosts 203 203
by using something like this. 204 204
Now instead of doing this though, 205 205
if I know what my hosts are, 206 206
I can list them out 207 207
individually by putting in their IP addresses. 208 208
So in my case, I do know all of my hosts, 209 209
which is 192.168.150.136, 210 210
which is my Kali Linux machine, then I'll put comma 211 211
and I'll add the next one. 212 212
I want to put my Windows machine, 213 213
which is 192.168.150.138. 214 214
I'll also want to include my Ubuntu machine, 215 215
which is 192.168.150.137, 216 216
and I also want to add my Metasploitable 2 machine, 217 217
which is 192.168.150.139, 218 218
and I can even add my Mac machine, which is 192.168.1.116. 219 219
Now notice those first four are all going to be 220 220
right next to each other, 136, 138, 137, and 139. 221 221
So instead of writing it out that way, 222 222
which takes a lot of time, 223 223
I can actually just use a dash in between 224 224
and do 136-139 and then I can get rid of 225 225
all of the rest of those and it will still scan 226 226
all four of those hosts because I'm doing everything 227 227
between 136 and 139, which includes 137 and 138. 228 228
I would still need to have a comma here to separate 229 229
that range from my Mac machine because my Mac machine 230 230
is outside of that range and it's a separate subnet. 231 231
Now in this case, this would give me five different machines 232 232
to scan and I think that's fine. 233 233
Another thing you can do is you can upload your targets 234 234
by adding something like a CSV file. 235 235
For example, you might have a CSV file with 1000 clients 236 236
spread across multiple subnets. 237 237
Instead of typing them all in, 238 238
you can just import that file by clicking Add file here. 239 239
The next thing we're going to do 240 240
is go down to our schedule option. 241 241
From schedule, we can enable or disable this, 242 242
right now this is disabled, 243 243
but I want to go ahead and enable this. 244 244
Now by doing this, I can schedule scans 245 245
and allow them to happen once a week, once a day, 246 246
once a month, or once a year. 247 247
For example, we mentioned the fact that 248 248
there are these quarterly PCI DSS scans 249 249
that we do all the time as cybersecurity analysts. 250 250
You can set those up here and say "Once a quarter, 251 251
on the first of every third month, 252 252
I want you to run a full PCI DSS quarterly scan 253 253
and give me those results." 254 254
So a lot of this can be automated and set up 255 255
so you don't have to sit here 256 256
waiting for these scans to complete. 257 257
In my case, I'm going to go ahead and enable this 258 258
and we're going to say we want to do this as a frequency 259 259
of weekly and I want to do this every Saturday morning 260 260
starting at 1:00 AM. 261 261
So I'll click on that and the first Saturday 262 262
we're going to come to is going to be January 14th, 2023. 263 263
You'll then select the time zone associated with that 264 264
and for me that's going to be the East coast, 265 265
which is New York inside of the United States 266 266
and then I'll repeat this every week 267 267
and I can choose which day I want it to happen, 268 268
and in my case, I want it to happen every Saturday. 269 269
So I'm just going to go ahead and highlight the Saturdays there 270 270
and you can see the summary at the bottom. 271 271
It repeats every week on Saturday at 1:00 AM, 272 272
starting Saturday, January 14th, 2023, 273 273
and that's how you can set up a scheduled scan. 274 274
The next thing we can do is go to our notifications tab. 275 275
Under notifications, we can configure an SMTP server 276 276
and then we can send an email when our scans are complete. 277 277
So after it scans this thing at 1:00 AM on Saturday, 278 278
it can then email me a PDF report that says, 279 279
"Here's all the vulnerabilities I found" 280 280
and so again, this makes it a really nice automated process 281 281
for us as cyber security analysts 282 282
and sort of something you might want to go ahead and set up. 283 283
In addition to that, you can also use results filters. 284 284
So you can say, "Hey, only email me if this happens 285 285
or don't email me when this happens." 286 286
The next thing we're going to do is click on discovery. 287 287
Under discovery, we're going to say what kind of types 288 288
we want to use for our scans. 289 289
Now by default, the most common 290 290
is going to be doing a port scan of the common ports. 291 291
This is usually the 1000 most commonly used ports, 292 292
and this will be a much quicker way 293 293
of doing a discovery scan, but you could miss some things. 294 294
So personally I like to do a more comprehensive scan 295 295
and I will do a scan of all ports on those machines 296 296
or if you're looking for a specific port only, 297 297
like which ones are web servers, 298 298
I can do that by doing a custom port and in that case 299 299
I would just select custom and then I would be able 300 300
to choose my own discovery settings 301 301
by doing the host discovery, port scanning, 302 302
service discovery or identity 303 303
and in this case it'd be service discovery 304 304
that I would be looking for a particular type of web server 305 305
like an Apache web server over port 80 or port 443. 306 306
So again, this just gives you additional areas. 307 307
For our use case though, we're going to go ahead 308 308
and stick with the all port scan, 309 309
which will go ahead and scan all of the ports available 310 310
and it'll use Netstat if the credentials are provided 311 311
and it'll use a SYN scanner if necessary, 312 312
'cause sometimes PinkSCANs won't work. 313 313
The next thing we're going to look at is our assessment. 314 314
Under assessment, 315 315
we're also going to choose the scan type here. 316 316
The default is going to be our most basic scan, 317 317
and right now we're not even scanning 318 318
for web application vulnerabilities. 319 319
This is fine if we're going to be scanning a bunch of hosts 320 320
that are on a network such as people's workstations 321 321
because they shouldn't be running web applications on those, 322 322
but if you're checking a web server, 323 323
you would want to enable those web application scans, 324 324
and in my case, one of my machines, 325 325
the Metasploitable 2 machine is running a web server. 326 326
So I want to change that from default 327 327
and I want to go ahead and say 328 328
Scan for all web vulnerabilities complex. 329 329
This is going to be our most thorough and in-depth scan, 330 330
and again, there is an option to do a custom scan 331 331
where you can set up all your different parameters. 332 332
Next, we have our report. 333 333
Under our report we have the ability 334 334
to set up different things, 335 335
including the ability to designate hosts 336 336
by their DNS name, be able to show all the hosts 337 337
that responded to a ping, 338 338
display any hosts that were unreachable. 339 339
For example, you said you expected a hundred machines 340 340
to be online, but you only found 73. 341 341
What were the other 27 machines that were offline? 342 342
Well, if you display unreachable hosts there at the bottom, 343 343
that will actually show that to you in your report 344 344
and so all of these things are things that you can configure 345 345
for part of your reporting. 346 346
Then we'll go into our advanced tab, and again, 347 347
here's another scan type. 348 348
We're using the default right now, which is fine. 349 349
If you're scanning over a low bandwidth link, 350 350
such as a VPN or some kind of remote office connection, 351 351
you may want to use that or again, you can use custom 352 352
where you can use more or less scanners each time. 353 353
In my case, using the default, 354 354
this says I'm going to be able to scan 355 355
up to 30 hosts at one time. 356 356
I can do four checks per host at one time 357 357
and I have a five second network readout timeout. 358 358
If I wanted to increase that or decrease that, 359 359
I could do that by using the custom area. 360 360
The next tab we have is our credentials. 361 361
Now as you know, you can either use credentialed 362 362
or uncredentialed scans, 363 363
and if you're going to use credentialed scans, 364 364
that means you're giving it the username and password 365 365
for an account on that given system. 366 366
If you're using a Windows machine that you're scanning, 367 367
you'll simply click on Windows 368 368
and then enter in your username and password there 369 369
and save that and it'll allow Nessus to connect 370 370
to that machine using those user credentials 371 371
and be able to get a better idea 372 372
of what vulnerabilities exist. 373 373
I've already done a scan of doing both a credentialed 374 374
and non-credentialed scan against my Windows 11 machine, 375 375
and you'll see that when we did a credentialed scan, 376 376
we actually found one additional vulnerability 377 377
that wasn't found when we did an uncredentialed scan. 378 378
So it's important to realize this 379 379
and determine which type of scan you want to do. 380 380
If you're trying to see what vulnerabilities exist 381 381
for an outside attacker, then doing an uncredentialed scan 382 382
would be the way to go. 383 383
If you want to see what an insider threat could do, 384 384
who has a valid login and password, 385 385
then using something like a credentialed scan 386 386
would make sense and the final tab we have is our plug-ins. 387 387
Now plug-ins inside Nessus are used to be able to 388 388
check for certain vulnerabilities. 389 389
Here you can see the plugin families down the left 390 390
and then the plug-in names on the right. 391 391
For example, if I go down here and I go all the way 392 392
to the bottom, you'll see that we have 393 393
three different ones for Windows. 394 394
The first one in the Windows family 395 395
has a whole bunch of plugins and you can see them 396 396
listed on the right. 397 397
For example, we could be checking to see if team viewers 398 398
insecure directory permissions privilege escalation 399 399
is something our machine is vulnerable with. 400 400
That's because we have that plug in there, 135708, 401 401
and it will check that when we're doing our scans. 402 402
Right now, all these plug-ins are enabled 403 403
and we're going to be using all of them when we do our scan, 404 404
but we could check for just a single vulnerability as well. 405 405
Essentially, if there is a vulnerability out there 406 406
that's known, Nessus will go ahead and make a new plugin 407 407
and release that to the client. 408 408
Speaking of that, how do you update your scanner 409 409
to ensure you have all the latest plugins? 410 410
Well, the best way to do that 411 411
is by clicking on the settings tab at the top, 412 412
but we'll do that after we finish creating our scan. 413 413
Now that we've looked at all the plug-ins we want, 414 414
we can go ahead and hit save and that will save that for us 415 415
and then from here it's asking us for the credentials 416 416
for our Windows machine. 417 417
In our case, we don't want to use that, 418 418
so I'm just going to hit the X over here 419 419
and then I'm going to hit Save. 420 420
From here, we now see that my network scan 421 421
is added to my list and it will run every week 422 422
on Thursday at 1:00 AM. 423 423
The reason it says Thursday is because that's today's date 424 424
when I did it, 425 425
but the first scheduled time is going to be Saturday 426 426
at 1:00 AM based on the configuration we did. 427 427
Now let's go ahead and take a look at 428 428
how you can update your plugins. 429 429
To do this, you're going to go and click on Settings at the top 430 430
and from settings you'll then go down 431 431
and look at your scanner health. 432 432
From your scanner health, 433 433
you'll see the overall health of your scanner. 434 434
In my case, you can see how much memory is used, 435 435
what CPU load is currently ongoing, 436 436
and the hosts that are being scanned as well as some graphs 437 437
showing all that information. 438 438
In addition to that, we can look at the network activity 439 439
by clicking on the network tab over here, 440 440
and that will show us some information 441 441
about the running scans and the active targets 442 442
that we're looking at, as well as what sessions are there. 443 443
If we want to be able to update our scanner, 444 444
we want to make sure that we check our about area 445 445
and this will tell us what version we have as well as 446 446
what plugin set and policy template version we're using, 447 447
as you can see over on the right hand side. 448 448
In addition to that, you can see the fact that 449 449
this was last updated today, 450 450
and if I wanted to update it again, 451 451
I would simply click on the little refresh button 452 452
next to that to see when the last update was, 453 453
and if you click on software update, 454 454
you'll be able to see if it is configured properly 455 455
to get all of the updates for the components for the plugins 456 456
or if we disable automatic updates. 457 457
Personally, I like to use automatic updates, 458 458
especially when I'm a home user doing this 459 459
in my home system. 460 460
If you're in a corporate environment though, 461 461
do check your policies because some organizations 462 462
don't want you to update your components or plugins 463 463
directly from Nessus 464 464
and instead want to use their own custom server, 465 465
and you can configure that here under the update server 466 466
with your custom URL being added in there. 467 467
All right, now that we have all that, 468 468
let's go back to our scans and take a look 469 469
at some of the things that I've already run 470 470
so we can see what these scans look like. 471 471
Alright, let's go ahead and take a look 472 472
at our Windows machines first. 473 473
Now, I mentioned I had two of them done here. 474 474
One was a credentialed and one was an uncredentialed scan. 475 475
Let's take a look at our uncredentialed scan first. 476 476
If I click on my Windows machine, 477 477
you'll see that it has its IP address 478 478
and we have 10 vulnerabilities that were identified. 479 479
Those vulnerabilities though aren't really that significant 480 480
because they're just informational. 481 481
There are no criticals, no highs, no mediums and no lows. 482 482
As you look at the scan details, 483 483
you could see when it started and when it stopped, 484 484
and in this case it took me six minutes to scan one machine. 485 485
In addition to that, you can click on vulnerabilities, 486 486
and from here you'll see all 10 vulnerabilities 487 487
that were found as well as what their severity is, 488 488
whether it's info low, medium, high or critical, 489 489
and in my case, they're all informational. 490 490
In addition to that, you'll have a score 491 491
that's associated with it, if it is a critical high, 492 492
medium or low based on CVSS 3.0 or 3.1, 493 493
as well as the name of that vulnerability, 494 494
the family of plug-in it came from and the number of counts. 495 495
In our case, there's only one count for each, 496 496
because we only scanned one machine, 497 497
but if I scanned my entire network, 498 498
like the scan that we just set up, 499 499
that would actually go and look at all the machines 500 500
on the network, and in my case, there was five of them, 501 501
and if two or three of those machines had it, 502 502
we would see that number here under the count. 503 503
In addition to that, we also have this tab, 504 504
called the VPR top threats. 505 505
Now, this is a proprietary technology 506 506
used by Tenable the makers of Nessus 507 507
to tell you what is the most vulnerable things. 508 508
Now, similar to a CVSS score, you can't rely on these solely 509 509
because this is just Nessus best guess at what they think 510 510
is the most vulnerable, 511 511
but they don't really understand your network 512 512
as well as you do. 513 513
For example, they may say that there's a server 514 514
with a really critical vulnerability that has to be patched, 515 515
but when you look at that server, 516 516
it's actually in an isolated subnet that nobody can reach 517 517
and therefore it's not really that vulnerable to attack, 518 518
and so it may not be as big of a priority 519 519
as something that's a high or medium 520 520
that is publicly facing, such as a web server 521 521
inside of a screen subnet or demilitarized zone 522 522
and then the last tab we have is our history tab, 523 523
and this shows us all the scans that have been made 524 524
with that profile. 525 525
In this case, that's my profile 526 526
of Windows 11 uncredentialed, 527 527
and you can see here I only scanned one machine one time. 528 528
If I go back to the vulnerabilities tab, 529 529
you can also see that these vulnerabilities 530 530
when you click on them will give you additional information. 531 531
For example, if I click on the device type, 532 532
the reason this is informational 533 533
is because it's saying based on the remote operating system, 534 534
it's possible to determine what remote system type is, 535 535
such as a printer, router, general purpose computer, 536 536
or whatever it is, and we have a 70% confidence level 537 537
that this is a Windows 11 general purpose machine 538 538
based on the basic scan that we just did. 539 539
In addition to all of that, 540 540
once you have all your vulnerabilities, 541 541
you don't have to just click through them all here. 542 542
You can actually do it as a report too. 543 543
In order to do this, simply click on report 544 544
and then you'll select the type of report you want, 545 545
whether you want a complete list of vulnerabilities by host, 546 546
detailed vulnerabilities by host, 547 547
detailed vulnerabilities by plugins 548 548
or vulnerabilities operations. 549 549
Now, when you do detailed vulnerabilities by host, 550 550
this is what we're seeing here where we have 551 551
10 vulnerabilities associated with this single host, 552 552
but again, if I had five or 10 or 500 machines, 553 553
I might want to look at the vulnerabilities by plugin 554 554
so I could say which one has the most 555 555
or which one is the most critical, 556 556
and then I could see all the machines associated with that. 557 557
In our case, we're going to do it by host, 558 558
because we only have one host scanned here, 559 559
and then we'll go ahead and hit Generate report here 560 560
to generate our report as a PDF. 561 561
You do have three options when generating your report. 562 562
You can do it as an HTML file, a PDF or a CSV file. 563 563
In my case, I used a PDF and you can see that PDF 564 564
is created right here, and it's a 15 page document 565 565
with all of the vulnerabilities and what they are 566 566
and how we can fix them. 567 567
So as we start scrolling through this, 568 568
we can see that we have a vulnerabilities by host 569 569
and there's only one host, 570 570
and then if we go down to page four, 571 571
we will now see the vulnerabilities. 572 572
Here we have zero critical, zero high, zero medium 573 573
and zero low, but we do have 10 informational. 574 574
We could see when the scan started and stopped, 575 575
we could see information about that host 576 576
and then we start seeing the vulnerabilities themselves. 577 577
For example, the first vulnerability we have 578 578
is that common platform enumeration or CPE, 579 579
and this says we are able to figure out 580 580
what type of system it was, and so as we look at that, 581 581
we can see the output from it and we can see that 582 582
it identified us as a Windows host and that is correct. 583 583
So that is a informational thing. 584 584
It's not really a dangerous thing, 585 585
but if you didn't want people to know 586 586
you're running a Windows machine, 587 587
you could do some things to obfuscate that 588 588
and make it report that it's a Linux machine 589 589
or a Mac machine or something like that. 590 590
If you wanted to use some kind of security 591 591
by obscurity technique. 592 592
Then we can keep scrolling, we'll see the next thing. 593 593
In our case, we see a device type, 594 594
and again, we saw this was a general purpose machine. 595 595
We saw that earlier when we were looking at 596 596
inside of Nessus tool. 597 597
As we continue to go down, 598 598
you'll see more information of all the things we found. 599 599
Now here, because these were informational, 600 600
it's not nearly as helpful as when we find things 601 601
that have true vulnerabilities, 602 602
because then it will give us information 603 603
about the vulnerability and how to solve it. 604 604
Let me show you what that looks like in just a minute. 605 605
Right now, let's go back to our scans and take a look 606 606
at our credentialed scan. 607 607
Now with the uncredentialed scan, we had 10 things found. 608 608
Here in the credentialed scan, 609 609
we do find that we have 11 things, 610 610
and so we can compare the two 611 611
and we can look at one versus the other 612 612
and see what the difference is 613 613
and what that one extra thing was, 614 614
but again, because these are all informational, 615 615
it's really not that big of a deal, 616 616
and so we're going to go look at some other scans 617 617
that may have some better information for us. 618 618
The next one we're going to look at 619 619
is going to be our Kali machine. 620 620
Our Kali machine is actually a very secure machine as well, 621 621
having 57 informational items and only one low item here 622 622
as a vulnerability. 623 623
This scan actually took 16 minutes to complete 624 624
on this single machine, and we look at the vulnerabilities, 625 625
we have 44 of them total. 626 626
Now the reason there's 44 is because there's lots of them 627 627
that have multiple issues such as HTTP has three, 628 628
SSH has four, SSL has five, and things like that. 629 629
When we look at the SSL one, you can see it says mixed, 630 630
and the reason for that is when I click on this, 631 631
it works almost like a folder. 632 632
You could see there was four informational 633 633
and one medium vulnerability. 634 634
This is our first vulnerability 635 635
that actually is a number or score associated with it. 636 636
In this case, that's 6.5, giving us a medium classification. 637 637
If I click on that, we could see the additional information, 638 638
and in this case it says the SSL certificate 639 639
cannot be trusted and the reason for this 640 640
as we look at the output below from the scanner 641 641
is that we got information from the system we were scanning, 642 642
in this case, our Kali Linux machine, 643 643
and it did have information about the subject 644 644
and issuer of that digital certificate, 645 645
but it was a self-signed certificate 646 646
and therefore it's being registered 647 647
as signed by an unknown certificate authority 648 648
and that is why this is considered a vulnerability. 649 649
Now, in my case, because I'm in a lab environment, 650 650
this isn't really a big vulnerability, and again, 651 651
it's only a medium level of vulnerability, 652 652
but it is the only vulnerability we have on the system, 653 653
and that tells me this Kali machine is rather secure. 654 654
If I wanted to solve this problem, 655 655
I could then go through and figure out 656 656
why is this using a self-signed certificate 657 657
and how can I get it its own certificate? 658 658
In this case, it tells me my solution is to purchase 659 659
or generate a proper SSL certificate 660 660
for this service, and I can actually go look 661 661
at those two links to see how to do that 662 662
or get more information about this particular vulnerability. 663 663
Let's go ahead and go back to our scans, 664 664
and from here we're going to go and look at our Mac machine. 665 665
Now, the Mac machine is a machine I use on a daily basis, 666 666
and here you can see I have 33 informational 667 667
and one that is a medium vulnerability. 668 668
Let's see what that one is. 669 669
As I click on the vulnerabilities tab, 670 670
I see there are multiple SSL issues 671 671
and it's the exact same issue we had on Kali. 672 672
Now, why is this? 673 673
Well, on my Mac system, I also have Nessus there 674 674
and Nessus is using that same self-signed certificate again 675 675
inside of that installation on my Mac machine, 676 676
and therefore we're getting the same vulnerability, 677 677
so I would want to go ahead and install a real certificate 678 678
instead of using the self-signed one from Nessus 679 679
to avoid this vulnerability. 680 680
Next, let's go back to my scans, 681 681
and from here we're going to look at Ubuntu. 682 682
Now this a Ubuntu is one that I just installed 683 683
straight off the CD and all I did 684 684
was create a user account and then scan it. 685 685
So there is no patches that have been done, 686 686
but you can see that Ubuntu is pretty secure 687 687
straight from its installation. 688 688
This is because as part of the installation process, 689 689
Ubuntu usually will download any new patches 690 690
and vulnerability updates that it has 691 691
before finishing the installation, 692 692
and that's why we're seeing 693 693
that this is a pretty secure machine. 694 694
If we look at these vulnerabilities, 695 695
they're all informational again, 696 696
and from here you can see it's most of the same stuff. 697 697
We're getting information about the system 698 698
such as its Mac address, it's IP protocols being scanned 699 699
and things like that. 700 700
Let's go back to our scans one more time, 701 701
and from here you can see that 702 702
my other two scans are still running. 703 703
The basic scan of my entire network 704 704
and the Metasploitable 2 one. 705 705
Let me go ahead and look at Metasploitable 2 first, 706 706
because this one has a lot of vulnerabilities. 707 707
Now, you'll notice here that I can't export this 708 708
as a report yet, and the reason is, 709 709
it's still running this scan. 710 710
I started this scan over an hour ago 711 711
and we're still at only 99%, 712 712
but we found a lot of vulnerabilities. 713 713
Here even at 99%, we can see 171 informational, 714 714
eight lows, 44 mediums, 13 highs, and 15 criticals. 715 715
This is a really vulnerable system, 716 716
and if this was on your production network, 717 717
you would definitely want to start remediating 718 718
all these issues. 719 719
So what are some of these issues? 720 720
Well, let's go ahead and click on our vulnerabilities 721 721
and we'll look at the first one we have, 722 722
which is NFS Exported share Information disclosure, 723 723
and this is a 10.0, which is critical. 724 724
You could see it's under the RPC or Remote Procedure Call 725 725
family of plugins, and it happened one time on the system. 726 726
If I click on it, I can get more information about it, 727 727
going down the left, I'll see the description, 728 728
the solution, and the output we got from the scanner, 729 729
and on the right we'll see information about the plugin 730 730
such as its ID, the severity, the version, 731 731
the type, the family, when it was published 732 732
and when it was last modified. 733 733
As you can see, this is a really well known 734 734
and old vulnerability from all the way back in 2003 735 735
over 20 years ago. 736 736
In addition to that, we could see risk information 737 737
such as what the risk factor, is in this case critical, 738 738
and the score that it's associated with it, 739 739
in this case, a 10.0 critical 740 740
under the CVSS version two standard. 741 741
Now, why isn't CVSS version three or version 3.1 here? 742 742
Well, because this is a really old vulnerability 743 743
from 20 years ago and they haven't updated it 744 744
to the latest scoring system, 745 745
but we still know it's very vulnerable. 746 746
Then we could see vulnerability information on the right 747 747
that says things like, "Is there an exploit available?" 748 748
True, yes, there is. 749 749
That again, makes it even more serious for us 750 750
to patch this vulnerability, 751 751
because not only are we vulnerable, 752 752
but attackers also know how to exploit it. 753 753
In addition to that, we can see the ease of that exploit 754 754
is that exploits are publicly available 755 755
and the vulnerability was first known 756 756
back on January 1st of 1985, 757 757
so it's really, really old vulnerability here. 758 758
You can see what you can exploit it with. 759 759
In this case, you can use Metasploite, 760 760
and we can see reference information 761 761
including the CVEs associated with it, 762 762
which were all written back in 1999, 763 763
and you can see that because it says CVE-1999 dash, 764 764
and then the number for the three CVEs 765 765
associated with this vulnerability. 766 766
Let's go back to our vulnerabilities again. 767 767
We'll click on the next one, 768 768
which is the REXECD service detection. 769 769
Here we see that that service is running on the host 770 770
and it's designed to allow users of the network 771 771
to execute commands remotely, 772 772
which could be a bad thing for us 773 773
as cyber security professionals. 774 774
So to fix it, you would comment out the exec line 775 775
inside the /etsy/inetd.configfile 776 776
and then restart the INETD process. 777 777
So this one's a pretty easy one to fix, 778 778
and so we can go in, comment out that line, 779 779
and then we would be able to restart the process, 780 780
rescan our system, and verify 781 781
that this critical vulnerability is no longer there. 782 782
Let's go ahead and look at our vulnerabilities again. 783 783
Let's scroll down here and take a look at 784 784
our bind shell backdoor detection. 785 785
This one has a 9.8 rating, and again, 786 786
you can see that this is a shell listening on a remote port 787 787
without any authentication being required, 788 788
and this would be a really bad thing 789 789
because the attacker can use it 790 790
to connect to the remote port 791 791
and send commands directly to that system. 792 792
How do we solve this? 793 793
Well, we want to verify if the remote host 794 794
has been compromised and then reinstall the system 795 795
if necessary. 796 796
Essentially, we think this is a backdoor 797 797
or a root kit of some kind, 798 798
and this would be a really bad thing, 799 799
so we would want to be able to fix that 800 800
and again, you can see all the details there, 801 801
including the CVSS scores over on the right hand side. 802 802
If we go back to our vulnerabilities, 803 803
we can look at some other ones, 804 804
such as our highs, our mediums, or our lows 805 805
by clicking through all of these, 806 806
but because there are so many here, 807 807
what I would probably do is instead I would run my report, 808 808
export that as a PDF, showing me all the vulnerabilities, 809 809
including all of the solutions for those vulnerabilities, 810 810
and then we can pass that over to our system administrators 811 811
in a prioritized manner, 812 812
which tells 'em which things we want them to fix first, 813 813
and then once they tell us they've done that, 814 814
we would re-scan the system to see if our 95 vulnerabilities 815 815
now went down to 50 or 40 or 20 or 10 or maybe even zero, 816 816
but that's probably not going to happen because as you saw, 817 817
even really secure hosts still have five or 10 or 15 818 818
of these informational things and on this system, 819 819
we have quite a few informational as well 820 820
with 57% of our findings being informational, 821 821
but again, what I'm really worried about is these criticals, 822 822
these highs, and then even the mediums. 823 823
The lows don't usually worry me as much, 824 824
and then the informational 825 825
don't usually worry me as much either. 826 826
These are the kind of things you need to look at 827 827
as you're going through a tool like Nessus. 828 828
The last one we have is our basic scan 829 829
of the entire network. 830 830
Now here you can see that I had four machines 831 831
inside of the scope of this particular scan, 832 832
and the one that isn't there is Metasploitable 833 833
because I added that in after this scan started. 834 834
Now because of that, you can see which machines we have 835 835
in this case, the dot 136 is my Kali Linux machine. 836 836
The dot 116 is my MAC system. 837 837
The dot 138 is my Windows 11 system, 838 838
and my dot 137 is my Ubuntu system. 839 839
As you can see here, this is what you want your network 840 840
to look like. 841 841
This is a nice clean scan. 842 842
We only have two low vulnerabilities, 843 843
and those low vulnerabilities were basically 844 844
self-signed certificates for the SSL 845 845
being run on the Nessus scanner itself. 846 846
So that tells me these systems aren't that vulnerable 847 847
to attack and they're in a pretty good shape. 848 848
This is what you want your systems to look like 849 849
by the time you're done doing all your remediation. 850 850
Unfortunately though, in most production networks, 851 851
your scans are going to look a lot more like this 852 852
than they are the one that I just showed you 853 853
and the reason for that is sometimes systems are offline 854 854
when people push patches. 855 855
Sometimes the systems don't take the patches. 856 856
Sometimes people say, Remind me later, 857 857
instead of installing those security patches, 858 858
and for all those reasons, 859 859
you start getting vulnerabilities in your system. 860 860
The nice thing about using a tool like Nessus though, 861 861
is by going through these and scanning an entire network, 862 862
you're going to be able to see very quickly 863 863
which machines you need to focus your efforts on. 864 864
So if I saw these four, plus the Metasploitable 2 VM 865 865
on the screen, 866 866
I would know immediately that the Metasploitable 2 VM 867 867
is the one I need to worry about, 868 868
because it already had so much other things 869 869
that were critical, high, medium, and low 870 870
in addition to the informational 871 871
and so that's where my attention would go. 872 872
That's the idea of using one of these tools 873 873
to identify what things are on your network 874 874
that are vulnerable and what things you can do 875 875
to fix those vulnerabilities.