In this lesson, I'm going to show you
how you can conduct scanning using a tool like Nessus.
Now, as we go through this lesson,
I'm going to be going through my own sample lab
and be able to do some scans
with Nessus across these different devices.
I'm doing these both individually and as a group.
Now what you're seeing here on the screen
is a visual representation of my current lab network.
Over on the left side, you'll see that at IP address
192.168.1.116.
That is a Mac machine
and that's actually my desktop that I'm using
to record this video to demonstrate how to use Nessus.
In addition to that, I also have a Kali Linux machine,
which is what I'm logged into now as a virtual machine.
All of the things that are starting with
192.168.150.something are part of my virtual network
in the lab environment,
whereas the Mac machine is part of my office network,
which is why it has a different IP address
starting with 192.168.1.something.
Now, as you look at the circle,
you'll see that there are different devices
that are connected to this virtual network,
including a Windows 11 machine at 192.168.150.138.
My local host, which is also my Kali Linux machine,
which is 192.168.150.129.
My Metasploitable 2 virtual machine is going to be
a very vulnerable client for us to us find a lot of issues
and vulnerabilities with and that's at 192.168.150.136.
And an Ubuntu Linux machine
that is located at 192.168.150.137.
Now, the Windows 11 machine, the Ubuntu machine,
and the Kali Linux machine should all be relatively secure
because they've just been installed
and they've been updated with the latest security patches.
The Metasploitable 2 machine, on the other hand,
will probably find a lot of vulnerabilities
because it is a vulnerable machine by default,
and we use this to be able to practice
our penetration testing skills
or our cybersecurity analyst skills
by finding those vulnerabilities
and then trying to patch them, re-scanning the machine,
and then seeing if we've solved
those vulnerabilities in the network.
All right, now that we have a basic understanding
of the network that we're going to be using,
let's go ahead and move into looking at Nessus.
All right. Here you can see the Tenable website,
and if you go to tenable.com, you can search
for the Nessus Essentials tool.
This is a free tool that used to be called Nessus Home,
and it allows you to scan your environment,
including all of your network,
up to 16 IP addresses per scanner,
using the same high speed in-depth assessments
that you'd get with the professional version of Nessus.
As a cybersecurity analyst,
you need to get comfortable using vulnerability scanners
like Nessus and OpenVAS,
because depending on where you work,
you'll either be using Nessus or OpenVAS or QualysGuard
or some other vulnerability scanner,
but most of them work pretty much the same way.
So in this lesson we're going to use Nessus Essentials
because it is something that is free to use
and you can download it
and do this on your own home network as well,
to see what vulnerabilities exist there.
To do that, simply go to this webpage,
enter in your first name, last name, and email address.
They'll take you to the download page
and they'll email you an activation code with a license key
that is good for about five years
for you to be able to start playing with Nessus
and getting used to how it works.
Once you have Nessus installed on your computer,
it's going to run as a program in the background
and essentially starts up a web server
that you can access on your local machine.
To access this, you'll go to local host colon 8834,
which is port 8834 on your local host,
which is the machine you're accessing it from.
In my case, that's my Kali Linux machine.
Once you're there, you're going to walk through the setup
wizard and then you'll create an account.
In my case, I've already done that,
so I'm just going to go ahead and log in using my account,
which is Dion Training.
Once you've done that, you'll be brought into
the My Scan screen.
Now the first time you do this,
you're going to have nothing listed here
because it is going to be a blank scan
because you haven't done anything with Nessus yet
because it's a brand new install.
In my case, I've already done a couple of these scans
for us, so that way we'll be able to look at the results
without having to wait a long time
for them to come back from doing the scans.
These scans can take a really long time
depending on the size of your network.
Even for a really small lab environment like the one I have,
I have that top scan,
which is a basic scan of my entire network.
It has been running for about 45 minutes at this point.
Now, in order to use Nessus,
you need to create a scan profile
and you can see I have several of them already created here.
I'm going to walk you through how you can create your own
scan profile, and then we'll take a look
at some of the results from my scanning profiles
that have already been run.
To do this, simply click New Scan at the top right corner
of your screen, and then from here you'll see
all the different types of scanners you have,
including discovery scanners, to be able to figure out
what hosts are on the network, vulnerability scanners
that will target specific vulnerabilities,
or we also have compliance scans.
Now, when you're using Nessus Essentials,
compliance scans are not something
you're going to be able to use.
These compliance scans are things like
PCI DSS internal network scans
or offline configuration audits,
or the PCI quarterly external scans
that are required once a quarter
if your organization takes credit cards
as part of their business model.
All these are things that are included
with the Nessus professional and expert versions,
but in the home version, which is Nessus Essentials,
these are actually blocked out
and you have to pay to get access to those.
For most of us though,
if we're doing this in our home network,
those don't actually matter that much
because you're probably not processing credit cards
on your home computer and instead you're more focused
on the things that are above,
which are the different vulnerabilities
or the discovery scan.
Now, if you're looking at these different vulnerabilities,
you'll notice these are targeted
for specific groups of vulnerabilities.
For example, you can see in the middle of my screen
there's one called the WannaCry Ransomware.
This was really popular back in 2017
and affected all Windows machines at the time.
When something like that comes out,
a lot of times Nessus will create
a specific scan vulnerability for that one plugin.
This way you can quickly look across your entire network,
even if you have a hundred or a thousand machines,
and check just for that one vulnerability.
That's the reason why you're seeing
these vulnerabilities listed here,
because these are the ones that were really, really important
to look for, things like Specter and Meltdown
and WannaCry and Ripple20, and things like that.
So for our cases, we're not going to look at just a single
vulnerability, but we want to look at
what vulnerabilities exist across the entire network
so we can get a better idea of exactly what vulnerabilities
exist right now in our network
and create a baseline for us to use as we move forward.
To do this, we're going to do a basic scan.
So I'm just going to click over here
and do a basic network scan,
which is a full system scan suitable for any host,
and once I click on that, it's going to have me give it a name.
In my case, I'm just going to call it network scan,
and then I'm going to give it a description.
Now this is really helpful because these scans
are ones that you're going to create
and then use week after week and month after month,
and so six months from now you might forget
why did you call this "Network scan"?
So in my case, I'm going to say a lab demonstration
of using Nessus as a vulnerability scanner.
All right, and then we're going to save it into a folder.
We can do it in the my scans folder,
which you see in the top left corner,
or you have the all scans folder.
If I wanted to create a new folder, I can do that as well,
but for our purposes, the my scan folder
is going to be just fine.
And then we're going to list out our targets.
Now, when you're listing out your targets,
you can do this based on domain names like diontraining.com,
or by using IP addresses.
For example, if you're doing your internal local network,
you're probably going to have to use IP addresses
because you probably don't have a domain name associated
with each and every host on your network.
Now in my case, I'm using the 192.168.150.0/24 network.
Now, if I didn't know any of my hosts on that network,
I can scan the entire subnet of 256 hosts
by using something like this.
Now, instead of doing this though,
if I know what my hosts are,
I can list them out individually
by putting in their IP addresses.
So in my case, I do know all of my hosts,
which is 192.168.150.136,
which is my Kali Linux machine.
Then I'll put comma and I'll add the next one.
I want to put my Windows machine,
which is 192.168.150.138.
I'll also want to include my Ubuntu machine,
which is 192.168.150.137.
And I also want to add my Metasploitable 2 machine,
which is 192.168.150.139,
and I can even add my Mac machine,
which is 192.168.1.116.
Now notice those first four are all going to be
right next to each other, 136, 138, 137, and 139.
So instead of writing it out that way,
which takes a lot of time,
I can actually just use a dash in between
and do 136 dash 139,
and then I can get rid of all of the rest of those
and it will still scan all four of those hosts
because I'm doing everything between 136 and 139,
which includes 137 and 138.
I would still need to have a comma here to separate
that range from my Mac machine,
because my Mac machine is outside of that range
and it's a separate subnet.
Now in this case, this would give me five different machines
to scan, and I think that's fine.
Another thing you can do is you can upload your targets
by adding something like a CSV file.
For example, you might have a CSV file
with 1000 clients spread across multiple subnets.
Instead of typing them all in, you can just import that file
by clicking add file here.
The next thing we're going to do is go down
to our schedule option.
From schedule we can enable or disable this.
Right now this is disabled,
but I want to go ahead and enable this.
Now by doing this, I can schedule scans
and allow them to happen once a week, once a day,
once a month, or once a year.
For example, we mentioned the fact
that there are these quarterly PCI DSS scans
that we do all the time as cybersecurity analysts.
You can set those up here
and say once a quarter on the first of every third month,
I want you to run a full PCI DSS quarterly scan
and give me those results.
So a lot of this can be automated and setup,
so you don't have to sit here waiting
for these scans to complete.
In my case, I'm going to go ahead and enable this
and we're going to say we want to do this as a frequency
of weekly, and I want to do this every Saturday morning
starting at 1:00 AM.
So I'll click on that and the first Saturday
we're going to come to is going to be January 14th, 2023.
You'll then select the time zone associated with that,
and for me that's going to be the East coast,
which is New York inside of the United States.
And then I'll repeat this every week
and I can choose which day I want it to happen,
and in my case, I want it to happen every Saturday.
So I'm just going to go ahead and highlight the Saturdays
there, and you can see the summary at the bottom.
It repeats every week on Saturday at 1:00 AM
starting Saturday, January 14th, 2023,
and that's how you can set up a scheduled scan.
The next thing we can do is go
to our notifications tab.
Under notifications, we can configure an SMTP server
and then we can send an email when our scans are complete.
So after it scans this thing at 1:00 AM on Saturday,
it can then email me a PDF report that says,
here's all the vulnerabilities I found.
And so again, this makes it a really nice automated process
for us as cybersecurity analysts,
and so it is something you might want to go ahead
and set up.
In addition to that, you can also use results filters.
So you can say, hey, only email me if this happens
or don't email me when this happens.
The next thing we're going to do is click on discovery.
Under discovery, we're going to say what kind of types we want
to use for our scans.
Now by default, the most common is going to be doing a port
scan of the common ports.
This is usually the 1000 most commonly used ports,
and this will be a much quicker way
of doing a discovery scan, but you could miss some things.
So personally I like to do a more comprehensive scan
and I will do a scan of all ports on those machines,
or if you're looking for a specific port only,
like which ones are web servers,
I can do that by doing a custom port.
And in that case I would just select custom
and then I would be able to choose my own discovery settings
by doing the host discovery, port scanning,
service discovery or identity.
And in this case it'd be service discovery
that I would be looking for a particular type
of web server like an Apache web server
over port 80 or port 443.
So again, this just gives you additional areas.
For our use case though, we're going to go ahead
and stick with the all port scan,
which will go ahead and scan all of the ports available
and it'll use Netstat if the credentials are provided
and it'll use a SYN scanner if necessary,
because sometimes ping scans won't work.
The next thing we're going to look at is our assessment.
Under assessment, we're also going to choose
the scan type here.
The default is going to be our most basic scan,
and right now we're not even scanning
for web application vulnerabilities.
This is fine if we're going to be scanning a bunch of hosts
that are on a network such as people's workstations
because they shouldn't be running web applications on those.
But if you're checking a web server,
you would want to enable those web application scans,
and in my case, one of my machines,
the Metasploitable 2 machine is running a web server.
So I want to change that from default
and I want to go ahead and say scan for
all web vulnerabilities complex,
this is going to be our most thorough and in-depth scan.
And again, there is an option to do a custom scan
where you can set up all your different parameters.
Next, we have our report.
Under our report, we have the ability
to set up different things,
including the ability to designate hosts by their DNS name,
be able to show all the hosts that responded
to a ping, display any hosts that were unreachable.
For example, you said you expected 100 machines
to be online, but you only found 73.
What were the other 27 machines that were offline?
Well, if you display unreachable hosts there at the bottom,
that will actually show that to you in your report.
And so all of these things are things that you can configure
for part of your reporting.
Then we'll go into our advanced tab,
and again, here's another scan type.
We're using the default right now, which is fine.
If you're scanning over a low bandwidth link such as a VPN
or some kind of remote office connection,
you may want to use that or again,
you can use custom, or you can use more or less scanners
each time.
In my case, using the default,
this says I'm going to be able to scan up to 30 hosts
at one time.
I can do four checks per host at one time,
and I have a five second network read timeout.
If I wanted to increase that or decrease that,
I could do that by using the custom area.
The next tab we have is our credentials.
Now, as you know, you can either use credentialed
or un-credentialed scans,
and if you're going to use credentialed scans,
that means you're giving it the username and password
for an account on that given system.
If you're using a Windows machine that you're scanning,
you'll simply click on Windows
and then enter in your username and password there
and save that, and it'll allow Nessus to connect
to that machine using those user credentials,
and be able to get a better idea
of what vulnerabilities exist.
I've already done a scan of doing both a credentialed
and non-credentialed scan against my Windows 11 machine,
and you'll see that when we did a credentialed scan,
we actually found one additional vulnerability
that wasn't found when we did an un-credentialed scan.
So it's important to realize this
and determine which type of scan you want to do.
If you're trying to see what vulnerabilities exist
for an outside attacker,
then doing an un-credentialed scan would be the way to go.
If you want to see what an insider threat could do,
who has a valid login and password,
then using something like a credentialed scan
would make sense.
And the final tab we have is our plugins.
Now plugins inside of Nessus are used to be able to check
for certain vulnerabilities.
Here you can see the plugin families down the left
and then the plugin names on the right.
For example, if I go down here
and I go all the way to the bottom,
you'll see that we have three different ones for Windows.
The first one in the Windows family has a whole bunch
of plugins and you can see them listed on the right.
For example, we could be checking to see if team viewers
insecure directory permissions privilege escalation
is something our machine is vulnerable with.
That's because we have that plugin there, 135708,
and it will check that when we're doing our scans.
Right now, all these plugins are enabled
and we're going to be using all of them when we do our scan,
but we could check for just a single vulnerability as well.
Essentially, if there is a vulnerability out there
that's known, Nessus will go ahead and make a new plugin
and release that to the client.
Speaking of that, how do you update your scanner
to ensure you have all the latest plugins?
Well, the best way to do that is
by clicking on the settings tab at the top,
but we'll do that after we finish creating our scan.
Now that we've looked at all the plugins we want,
we can go ahead and hit save and that will save that for us.
And then from here it's asking us for the credentials
for our Windows machine.
In our case, we don't want to use that,
so I'm just going to hit the X over here
and then I'm going to hit save.
From here we now see that my network scan
is added to my list
and it will run every week on Thursday at 1:00 AM.
The reason it says Thursday is
because that's today's date when I did it,
but the first scheduled time is going to be Saturday at 1:00 AM
based on the configuration we did.
Now let's go ahead and take a look at
how you can update your plugins.
To do this, you're going to go and click on settings at the top
and from settings you'll then go down
and look at your scanner health.
From your scanner health,
you'll see the overall health of your scanner.
In my case, you could see how much memory is used,
what CPU load is currently ongoing,
and the hosts that are being scanned,
as well as some graphs showing all that information.
In addition to that, we can look at the network activity
by clicking on the network tab over here,
and that will show us some information about the running
scans and the active targets that we're looking at,
as well as what sessions are there.
If we want to be able to update our scanner,
we want to make sure that we check our about area,
and this will tell us what version we have
as well as what plugin set and policy template version
we're using, as you can see over on the right hand side.
In addition to that, you can see the fact
that this was last updated today,
and if I wanted to update it again,
I would simply click on the little refresh button
next to that to see when the last update was,
and if you click on software update,
you'll be able to see if it is configured properly
to get all of the updates for the components for the plugins
or if we disable automatic updates.
Personally, I like to use automatic updates,
especially when I'm a home user
doing this in my home system.
If you're in a corporate environment though,
do check your policies
because some organizations don't want you
to update your components or plugins directly from Nessus
and instead want to use their own custom server,
and you can configure that here under the update server
with your custom URL being added in there.
All right, now that we have all that,
let's go back to our scans
and take a look at some of the things
that I've already run so we can see what these scans
look like.
All right, let's go ahead
and take a look at our Windows machines first.
Now, I mentioned I had two of them done here.
One was a credentialed and one was an un-credentialed scan.
Let's take a look at our un-credentialed scan first.
If I click on my Windows machine,
you'll see that it has its IP address
and we have 10 vulnerabilities that were identified.
Those vulnerabilities though aren't really that significant
because they're just informational.
There are no criticals, no highs,
no mediums, and no lows.
As you look at the scan details,
you could see when it started and when it stopped,
and in this case it took me six minutes to scan one machine.
In addition to that, you can click on vulnerabilities,
and from here you'll see all 10 vulnerabilities
that were found as well as what their severity is,
whether it's info, low, medium, high or critical,
and in my case, they're all informational.
In addition to that, you'll have a score that's associated
with it if it is a critical high, medium, or low
based on CVSS 3.0 or 3.1,
as well as the name of that vulnerability,
the family of plugin it came from, and the number of counts.
In our case, there's only one count for each
because we only scanned one machine.
But if I scan my entire network,
like the scan that we just set up,
that would actually go
and look at all the machines on the network,
and in my case, there was five of them,
and if two or three of those machines had it,
we would see that number here under the count.
In addition to that, we also have this tab
called the VPR Top Threats.
Now, this is a proprietary technology
used by Tenable, the makers of Nessus,
to tell you what is the most vulnerable things.
Now similar to a CVSS score,
you can't rely on these solely
because this is just Nessus' best guess
at what they think is the most vulnerable,
but they don't really understand
your network as well as you do.
For example, they may say that there's a server
with a really critical vulnerability that has to be patched,
but when you look at that server,
it's actually in an isolated subnet that nobody can reach
and therefore it's not really that vulnerable to attack,
and so it may not be as big of a priority
as something that's a high or medium
that is publicly facing,
such as a web server inside of a screen subnet
or demilitarized zone.
And then the last tab we have is our history tab,
and this shows us all the scans
that have been made with that profile.
In this case, that's my profile of Windows un-credentialed,
and you can see here I only scanned one machine, one time.
If I go back to the vulnerabilities tab,
you can also see that these vulnerabilities
when you click on them
will give you additional information.
For example, if I click on the device type,
the reason this is informational is
because it's saying based on the remote operating system,
it's possible to determine what remote system type is,
such as a printer, router, general purpose computer,
or whatever it is, and we have a 70% confidence level
that this is a Windows 11 general purpose machine
based on the basic scan that we just did.
In addition to all of that, once you have
all your vulnerabilities,
you don't have to just click through them all here.
You can actually do it as a report too.
In order to do this, simply click on report
and then you'll select the type of report you want,
whether you want a complete list of vulnerabilities by host,
detailed vulnerabilities by host, detailed vulnerabilities
by plugins, or vulnerability operations.
Now, when you do detailed vulnerabilities by host,
this is what we're seeing here
where we have 10 vulnerabilities
associated with this single host.
But again, if I had 5 or 10 or 500 machines,
I might want to look at the vulnerabilities by plugin
so I could say which one has the most
or which one is the most critical,
and then I could see all the machines associated with that.
In our case, we're going to do it by host
because we only have one host scanned here,
and then we'll go ahead and hit generate report here
to generate our report as a PDF.
You do have three options when generating a report.
You can do it as an HTML file, a PDF or a CSV file.
In my case, I used a PDF
and you can see that PDF is created right here.
It's a 15-page document with all of the vulnerabilities
and what they are and how we can fix them.
So as we start scrolling through this,
we can see that we have a vulnerabilities by host
and there's only one host.
And then if we go down to page four,
we will now see the vulnerabilities.
Here we have zero critical, zero high, zero medium,
and zero low, but we do have 10 informational.
We could see when the scan started and stopped,
we could see information about that host,
and then we start seeing the vulnerabilities themself.
For example, the first vulnerability we have is
that common platform enumeration or CPE,
and this says we are able to figure out
what type of system it was.
And so as we look at that,
we can see the output from it
and we can see that it identified us
as a Windows host and that is correct.
So that is a informational thing.
It's not really a dangerous thing,
but if you didn't want people to know you're running
a Windows machine, you could do some things
to obfuscate that and make it report
that it's a Linux machine or a Mac machine
or something like that,
if you wanted to use some kind of security
by obscurity technique.
Then we can keep scrolling, we'll see the next thing.
In our case, we see a device type,
and again, we saw this was a general purpose machine.
We saw that earlier when we were looking at
inside of the Nessus tool.
As we continue to go down, you'll see more information
of all the things we found.
Now here, because these were informational,
it's not nearly as helpful
as when we find things that have true vulnerabilities
because then it will give us information
about the vulnerability and how to solve it.
Let me show you what that looks like in just a minute.
Right now, let's go back to our scans
and take a look at our credentialed scan.
Now with the un-credentialed scan we had 10 things found.
Here in the credentialed scan we do find
that we have 11 things.
And so we can compare the two
and we can look at one versus the other
and see what the difference is
and what that one extra thing was.
But again, because these are all informational,
it's really not that big of a deal,
and so we're going to go look at some other scans
that may have some better information for us.
The next one we're going to look at is going to be
our Kali machine.
Our Kali machine is actually a very secure machine as well,
having 57 informational items
and only one low item here as a vulnerability.
This scan actually took 16 minutes to complete
on this single machine,
and we look at the vulnerabilities we have 44 of them total.
Now the reason there's 44 is
because there's lots of them that have multiple issues
such as HTTP has three, SSH has four,
SSL has five, and things like that.
When we look at the SSL one, you can see it says mixed,
and the reason for that is when I click on this,
it works almost like a folder.
You could see there was four informational
and one medium vulnerability.
This is our first vulnerability that actually has a number
or score associated with it.
In this case, that's 6.5, giving us a medium classification.
If I click on that, we could see the additional information.
And in this case it says the SSL certificate
cannot be trusted.
And the reason for this as we look at the output
below from the scanner is
that we got information from the system we were scanning,
in this case, our Kali Linux machine,
and it did have information about the subject
and issuer of that digital certificate,
but it was a self-signed certificate
and therefore it's being registered as signed
by an unknown certificate authority.
And that is why this is considered a vulnerability.
Now, in my case, because I'm in a lab environment,
this isn't really a big vulnerability
and again, it's only a medium level vulnerability,
but it is the only vulnerability we have on the system,
and that tells me this Kali machine is rather secure.
If I wanted to solve this problem,
I could then go through and figure out why
is this using a self-signed certificate
and how can I get it its own certificate?
In this case, it tells me my solution is to purchase
or generate a proper SSL certificate for this service,
and I can actually go look at those two links
to see how to do that or get more information
about this particular vulnerability.
Let's go ahead and go back to our scans,
and from here we're going to go and look at our Mac machine.
Now, the Mac machine is a machine I use on a daily basis,
and here you can see I have 33 informational
and one that is a medium vulnerability.
Let's see what that one is.
As I click on the vulnerabilities tab,
I see there are multiple SSL issues
and it's the exact same issue we had on Kali.
Now, why is this?
Well, on my Mac system,
I also have Nessus there
and Nessus using that same self-signed certificate again
inside of that installation on my Mac machine,
and therefore we're getting the same vulnerability.
So I would want to go ahead
and install a real certificate
instead of using the self-signed one from Nessus
to avoid this vulnerability.
Next, let's go back to my scans,
and from here we're going to look at Ubuntu.
Now, this Ubuntu one is one
that I just installed straight off the CD
and all I did was create a user account and then scan it.
So there is no patches that have been done,
but you can see that Ubuntu is pretty secure
straight from its installation.
This is because as part of the installation process,
Ubuntu usually will download any new patches
and vulnerability updates that it has
before finishing the installation,
and that's why we're seeing that this is
a pretty secure machine.
If we look at these vulnerabilities,
they're all informational again,
and from here you can see it's most of the same stuff.
We're getting information about the system
such as its Mac address, its IP protocols being scanned,
and things like that.
Let's go back to our scans one more time,
and from here you can see that my other two scans
are still running.
The basic scan of my entire network
and the Metasploitable 2 one.
Let me go ahead and look at Metasploitable 2 first
because this one has a lot of vulnerabilities.
Now, you'll notice here that I can't export this as a report
yet, and the reason is it's still running this scan.
I started this scan over an hour ago
and we're still at only 99%,
but we found a lot of vulnerabilities.
Here even at 99%, we can see 171 informational, 8 lows,
44 mediums, 13 highs, and 15 criticals.
This is a really vulnerable system,
and if this was on your production network,
you would definitely want to start remediating
all these issues.
So what are some of these issues?
Well, let's go ahead and click on our vulnerabilities
and we'll look at the first one we have,
which is NFS Exported Share Information Disclosure,
and this is a 10.0, which is critical.
You could see it's under the RPC
or remote procedure call family of plugins,
and it happened one time on the system.
If I click on it, I can get more information about it.
Going down the left, I'll see the description, the solution,
and the output we got from the scanner,
and on the right we'll see information about the plugin
such as its ID, the severity, the version,
the type, the family, when it was published,
and when it was last modified.
As you can see, this is a really well-known
and old vulnerability from all the way back in 2003,
over 20 years ago.
In addition to that, we could see risk information
such as what the risk factor is, in this case critical,
and the score that is associated with it, in this case,
a 10.0 critical under the CVSS version two standard.
Now, why isn't CVSS version three or version 3.1 here?
Well, because this is a really old vulnerability
from 20 years ago and they haven't updated it
to the latest scoring system,
but we still know it's very vulnerable.
Then we could see vulnerability information on the right
that says things like, is there an exploit available?
True, yes, there is.
That again, makes it even more serious for us
to patch this vulnerability
because not only are we vulnerable,
but attackers also know how to exploit it.
In addition to that, we can see the ease of that exploit
is that exploits are publicly available
and the vulnerability was first known
back on January 1st, 1985,
so it's really, really old vulnerability here.
You can see what you can exploit it with.
In this case, you can use Metasploit,
and we can see reference information including the CVEs
associated with it, which were all written back in 1999,
and you can see that because it says CVE dash 1999 dash,
and then the number for the three CVEs
associated with this vulnerability.
Let's go back to our vulnerabilities again.
We'll click on the next one,
which is the "rexecd Service Detection".
Here we see that that service is running on the host
and it's designed to allow users of the network
to execute commands remotely, which could be a bad thing
for us as cybersecurity professionals.
So to fix it, you would comment out the 'exec' line
inside the /etc/inetd/.conf file,
and then restart the inetd process.
So this one's a pretty easy one to fix,
and so we can go in comment at that line,
and then we would be able to restart the process,
re-scan our system and verify
that this critical vulnerability is no longer there.
Let's go ahead and look at our vulnerabilities again.
Let's scroll down here and take a look at
our Bind Shell Backdoor Detection.
This one has a 9.8 rating,
and again, you can see
that this is a shell listening on a remote port
without any authentication being required,
and this would be a really bad thing
because the attacker can use it to connect
to the remote port and send commands
directly to that system.
How do we solve this?
Well, we want to verify if the remote host
has been compromised
and then reinstall the system if necessary.
Essentially, we think this is a backdoor
or a root kit of some kind,
and this would be a really bad thing,
so we would want to be able to fix that.
And again, you can see all the details there,
including the CVSS scores over on the right hand side.
If we go back to our vulnerabilities,
we can look at some other ones such as our highs,
our mediums, or our lows by clicking through all of these.
But because there are so many here,
what I would probably do is instead I would run my report,
export that as a PDF, showing me all the vulnerabilities,
including all of the solutions for those vulnerabilities,
and then we can pass that over
to our system administrators in a prioritized manner,
which shows them which things we want them to fix first,
and then once they tell us they've done that,
we would re-scan the system
to see if our 95 vulnerabilities now went down to 50 or 40
or 20 or 10 or maybe even 0.
But that's probably not going to happen because as you saw,
even really secure hosts still have 5 or 10 or 15
of these informational things.
And on this system, we have quite a few informational
as well, with 57% of our findings being informational.
But again, what I'm really worried about is these criticals,
these highs, and then even the mediums.
The lows don't usually worry me as much,
and then the informational don't usually worry me
as much either.
These are the kind of things you need to look at
as you're going through a tool like Nessus.
The last one we have is our basic scan
of the entire network.
Now here you can see that I had four machines
inside of the scope of this particular scan,
and the one that isn't there is Metasploitable
because I added that in after this scan started.
Now because of that, you can see which machines we have.
In this case the .136 is my Kali Linux machine.
The .116 is my MAC system.
The .138 is my Windows 11 system,
and my .137 is my Ubuntu system.
As you can see here, this is what you want
your network to look like.
This is a nice clean scan.
We only have two low vulnerabilities,
and those low vulnerabilities
were basically self-signed certificates
for the SSL being run on the Nessus scanner itself.
So that tells me these systems aren't that vulnerable
to attack and they're in a pretty good shape.
This is what you want your systems to look like
by the time you're done doing all your remediation.
Unfortunately though, in most production networks,
your scans are going to look a lot more like this
than they are the one that I just showed you.
And the reason for that is sometimes systems are offline
when people push patches,
sometimes the systems don't take the patches.
Sometimes people say, remind me later,
instead of installing those security patches.
And for all those reasons,
you start getting vulnerabilities in your system.
The nice thing about using a tool like Nessus though
is by going through these and scanning an entire network,
you're going to be able to see very quickly which machines
you need to focus your efforts on.
So if I saw these four plus the Metasploitable 2 VM
on the screen, I would know immediately
that the Metasploitable 2 VM is the one
I need to worry about
because it already had so much other things
that were critical, high, medium, and low,
in addition to the informational.
And so that's where my attention would go.
That's the idea of using one of these tools
to identify what things are on your network
that are vulnerable and what things you can do to fix
those vulnerabilities.