Narrator: Nessus. 2 2
In this lesson, we are going to start talking 3 3
about a vulnerability scanner, and this one is Nessus. 4 4
Now, Nessus is a commercial vulnerability scanner 5 5
that's produced by Tenable Network Security 6 6
for on-premise and cloud-based vulnerability scanning. 7 7
Now, Nessus is a great product 8 8
and as a home user, you are free to download it 9 9
and use it on your home network free of charge, 10 10
with even including an unlimited subscription. 11 11
Now, if you're going to use it in a business environment, 12 12
you do have to pay for it though, 13 13
because it is considered a commercial piece of software. 14 14
And so, if you want access to their subscription service, 15 15
which has all the latest plug-ins 16 16
that have all the vulnerabilities that you need to test for, 17 17
you do need to have a subscription 18 18
if you're using it under a commercial license. 19 19
But for us, as home users, and you want to 20 20
start getting practice with a vulnerability scanner, 21 21
I definitely recommend downloading Nessus 22 22
and start scanning your own network. 23 23
Start getting used to what it looks like to run these scans 24 24
and identify vulnerabilities within your own home networks. 25 25
There is no cost to do so, 26 26
and it would really help you out on the exam. 27 27
Now, when we talk about plug-ins, Nessus uses plug-ins. 28 28
And these are created using what's known 29 29
as the Nessus Attack Scripting Language. 30 30
Each of these plug-ins, there's one 31 31
for every single vulnerability that it's going to test. 32 32
So as you look at the plug-ins for Windows, 33 33
there are hundreds of vulnerabilities in Windows 34 34
and there are plug-ins for each one of those. 35 35
That is essentially the signatures 36 36
that Nessus is using to test those vulnerabilities 37 37
across the network. 38 38
Now, when you run a Nessus scan, 39 39
you're going to get something that looks like this 40 40
once the scan is done. 41 41
This will give you your scan results. 42 42
And now as you start looking at these results, 43 43
it makes it really easy from this dashboard 44 44
to identify what is vulnerable. 45 45
For instance, just looking here on this screen, 46 46
which do you think is the most vulnerable host 47 47
that has the most amount of issues 48 48
that I would want to look at first? 49 49
Would it be WIN7, Accounts or Marketing? 50 50
It'd be WIN7, right? 51 51
Because it has the most critical and the most high 52 52
and the most overall, in fact. 53 53
And so, that Windows 7 machine 54 54
is the most vulnerable of these three machines. 55 55
Now, does that mean it holds the most danger? 56 56
Well, maybe, maybe not. 57 57
Depends what's that machine being used for? 58 58
Again, the accounting machine might have 59 59
all of our bank account numbers 60 60
and all of our credit card processing data, 61 61
in which case, it would be more of a vulnerability 62 62
for me to go after, based on data criticality. 63 63
So that's why you can't just take these numbers 64 64
at their word, you have to look into them 65 65
and use your brain to figure out what is most important. 66 66
Now, from this screen, you can actually click 67 67
into that number 18 where those criticals are 68 68
and see a list of all the critical findings. 69 69
And you can see here, all these were critical. 70 70
You'll see the plug-in name, the plug-in family, 71 71
and the amount of count that we have. 72 72
So the top one there is actually a count of three. 73 73
We only scanned three workstations, 74 74
so that means all three of them have this vulnerability. 75 75
As I look further down the list, 76 76
I see some that only have one count, 77 77
which may be only on the Windows 7 machine 78 78
and not on Accounts or not on Marketing. 79 79
And so, this is the idea of how you 80 80
can start going through these reports 81 81
and figuring out where you need to focus your attention. 82 82
If I have something that has a three count, 83 83
in this case 'cause I had three pieces on the network, 84 84
that tells me that every machine is affected by this, 85 85
which means it's pretty vulnerable, 86 86
I have a very large attack surface. 87 87
So I would want to look into that, 88 88
figure out is there a way for me 89 89
to protect ourself from this, 90 90
whether that means blocking something at the firewall, 91 91
installing a software patch, or something of that nature. 92 92
Now, if you want to get even more details, 93 93
you can click into one of those. 94 94
For instance, let's go ahead and click into that first one 95 95
that affects all three machines. 96 96
As I click into that, I get a lot more details. 97 97
So going from the top down, 98 98
we're going to see this is a critical vulnerability. 99 99
It is Microsoft 15-034. 100 100
Now, Nessus is not showing me the CVE number here. 101 101
They're showing me the knowledge base article number. 102 102
So if I went to Microsoft's website 103 103
and went to MS15-034, there's a patch that I can download 104 104
and install to protect my systems based on that number. 105 105
It'll gimme a short description 106 106
of what this vulnerability is, what the solution is, 107 107
in this case, there's a patch from Microsoft, 108 108
go download it and install it, 109 109
and then a direct link to the tech article 110 110
for that knowledge base over on Microsoft's website 111 111
where I can download it. 112 112
It'll also show me what the output is 113 113
that Nessus expects to see when it tries to probe for this, 114 114
and any other information as you go down. 115 115
As you look at the bottom, it actually tells you 116 116
what ports were being used on this test and which hosts. 117 117
And that's where my screen got cut off, 118 118
but you could see Accounts. 119 119
That machine was one that was being affected. 120 120
On the right side, you could see 121 121
the details about this plug-in. 122 122
You could see it's a critical severity, 123 123
you could see a unique ID number, 124 124
you could see what version it is, 125 125
whether it's a local type or a network type, 126 126
if it's going to be in which type of family. 127 127
In this case it's Microsoft Windows 128 128
knowledge base articles, those bulletins. 129 129
And then when it was published and when it was modified. 130 130
You could also see some risk information. 131 131
This is a critical risk factor. 132 132
The CVSS score here is 10.0, 133 133
which is the highest it could be, right? 134 134
The temporal score is an 8.7, so it's been out for a while, 135 135
so it is less severe at this point 136 136
because it's older information 137 137
and most people have been patched to it. 138 138
As you go down to vulnerability information, 139 139
you see some information about that as well, 140 140
such as is there an exploit available? 141 141
And if there are, that means 142 142
it's going to be more of a risk to you, 143 143
so you want to make sure you take care of that. 144 144
And at the bottom, you could see 145 145
it's exploitable with Core Impact. 146 146
Now, what is Core Impact? 147 147
Well, Core Impact is a commercially available 148 148
penetration testing tool suite. 149 149
Now, if Core Impact has a penetration test exploit for this, 150 150
that means most hackers do too. 151 151
So if it's already there with Core Impact, 152 152
that means it is widely available, anyone can hack this. 153 153
So this is something I want to fix right away 154 154
because this is a big vulnerability for us. 155 155
Now, in addition to looking 156 156
at all this information within Nessus, 157 157
I can actually go outside of Nessus 158 158
and look up information on this vulnerability too. 159 159
For example, if I go to SANS, 160 160
I can get some information from the InfoSec Forums 161 161
on this particular knowledge base article. 162 162
Again, we can see this is a big vulnerability. 163 163
It has that big red and yellow text there 164 164
highlighted on the screen. 165 165
It says, "We have seen this out in our honeypots." 166 166
Their honeypots are on the internet, 167 167
so if they're seeing it, 168 168
it means there's exploits in the wild. 169 169
This is something we want to get fixed. 170 170
And so, this would be a bad vulnerability 171 171
that we need to start prioritizing 172 172
to patch our systems and get ourself corrected on this. 173 173
That's the idea of how you can look 174 174
at these reports inside of Nessus 175 175
and how you can use this information to make decisions. 176 176
Now, for the exam, 177 177
you don't need to memorize specific vulnerabilities 178 178
like the one I showed you here in this lesson 179 179
or EternalBlue that I showed you before. 180 180
But you do need to be able to read 181 181
and think through a report or a snippet 182 182
like what I showed you in this lesson. 183 183
It would be completely fair on the exam 184 184
to include something like a vulnerability scanners findings 185 185
with a short report with one or two items 186 186
and a description of those vulnerabilities 187 187
and possible fixes. 188 188
And then they can ask you to prioritize 189 189
which should be mitigated first and how. 190 190
In this example I just showed you, 191 191
you could see it would be a critical vulnerability. 192 192
There's an exploit that existed for it and a patch exists. 193 193
So this would be something that would be 194 194
a high priority for us to remediate, 195 195
and we can do that by installing the software patch 196 196
or update from the manufacturer, in this case, Microsoft.