-: Okay,
that was loading for over an hour
but it is finally over.
So we are ready to explore the Nessus tool.
It is pretty simple to use.
Your page should be blank
since you haven't performed any scan yet.
So we can click right here on this X button
just to see better this page.
And all we want to do from here
is go to the new scan button.
Right here, we will see all of the available options
that we can do for our scans.
So we got basic network scan,
as it says a full system scan suitable for any host.
We got the advanced scan, configure a scan
without using any recommendations,
and we got a bunch of the other options,
and for some of them
we need the Nessus professional version
in order to use
such as this one,
this one,
and all of these that have the upgrade on them.
Now as I already talked about
witness essentials, we're only going to
be able to scan local IP addresses.
Inside of a company, you could use this tool
to scan their networks for vulnerabilities.
However, you cannot scan an external IP address with this.
So scanning a website is not going to work,
unless it's inside of your network.
Another thing to remind you is that
we can scan with the free version up to 16 IP addresses.
And if I'm not mistaken,
those 16 IP addresses clean after 90 days.
So after 90 days you will be able to scan more IP addresses,
but I'm not sure about that.
And if you have a free version,
and you have more than 16 targets,
you'll have to scan that network with multiple Nessus scans.
So scanning big enterprise networks for big companies
will require Nessus professional version.
But what we want to do here to learn Nessus
and how to use it.
We want to go onto the basic network scan,
and this basic scan will require us to specify some options.
Now for our first scan, we'll be scanning only
metasploitable,
so turn it on.
If you haven't already,
check out the IP address of metasploitable.
In my case it is 192 dot 168 dot one dot four.
And once you do that, we can proceed to specify our options.
In the general tab,
under the name you can specify anything you want.
I will simply just type metasploitable.
Under the description, I will just leave this empty.
There is nothing ready to specify here.
You can put anything you want here,
just so you can recognize which type of scan you did,
and on which target you did it.
In the folder, we will leave it on My Scans,
and in the targets we specify the IP address
of our target machine.
Since right now we are only scanning one machine
we will specify the IP address of metasploitable.
But if you were to scan a network,
you would specify something like this
192 168 dot one dot one
slash 24,
in case it is a slash 24 network.
I believe you can also specify it like this,
so dash 192 dot one 68 dot one dot two 55.
But right now let us just go with our metasploit,
and with the free version, we can't even scan 255 hosts.
Remember? We can only scan 16.
Once you specify this,
we want to proceed to the schedule tab,
and here this schedule tab is useful
once you want to schedule your scans
in certain period of time,
or you just want to schedule a scan
while you're doing something else on the site.
For now, we're going to leave it off
under the notifications.
You can choose if you want to send results
to some emails over SMTP server.
We're not going to be doing that right now.
In the discovery tab, this is the important stuff.
Here we choose how many and which ports we want to scan.
We have an option of scanning common ports,
and this is similar to Nmap default port scan.
It'll only scan most popular ports,
or you can select scan (all ports)
which we're going to use right now
to scan all 65,000 ports in our metasploitable.
And if you want, there is a custom option
which is the third option right here,
but we are pretty satisfied
with this scan (all ports) option.
If we read the settings, the general settings
always test the Nessus local host,
Use fast network discovery.
Under the Port Scanner Settings, we have Scan all ports,
Use netstat if credentials are provided.
Use SYN scanner if necessary,
and we are pinging hosts
using TCP, ARP and ICMP.
Good. Once you set this to scan all ports,
you can go to the assessment,
and in the assessment tab
we can choose what we want to scan for.
So there are a few options.
If I click right here on this scan type,
we have Scan for known web vulnerabilities,
Scan for all web vulnerabilities,
and Scan for all web vulnerabilities (complex).
For the purposes of this tutorial,
we'll be scanning for known web vulnerabilities.
Why? Well, this will just take lesser time to finish.
When you run scan for complex web vulnerabilities
it usually takes a lot more time,
and we can see right here under the General Settings:
Avoid potential false alarms,
Enable CGI scanning,
and Web Applications will Crawl up to 1000 pages,
up to six directories,
and we will test for non vulnerabilities
in commonly used web applications.
These are our assessment settings,
but also keep in mind
that if we discover some web vulnerabilities
we will see how to attack them
in the web penetration testing section.
That will come right after the exploitation section.
For now, let us just see
whether Nessus will find something juicy.
Right after, we go to the report settings,
and usually you want to leave this on default
so we are are not going to be changing anything right here.
And finally in the advanced tab,
we will leave it on default for now,
and proceed to click on save.
So click on save right here,
and you should have your scan right here.
Now you will notice that it does not automatically start,
we must launch it.
And we do that
by clicking on this arrow right here which says launch.
Click on it.
In just a few seconds,
here it is.
These green arrows will start spinning
and our scan has officially started.
This will try to discover all the vulnerabilities
it can find for the metasploitable machine.
Now keep in mind that these scans can take a lot longer
than Nmap scans.
You can always check the current state of scan
by clicking on the scan name,
in our case, on the metasploitable.
And you will be able to see what it managed to find
for now during the scan.
Different vulnerabilities will be marked
with different colors.
We will have blue color which means information disclosure.
And what that is,
it possibly managed to
find some information that should be private,
or it managed to find this service version,
or something similar that allows us
to find out more information about the target.
It doesn't necessarily mean
that the information is useful though.
Then we have green, yellow
and orange vulnerabilities are also known as low
medium and high vulnerabilities.
And at the end, we get the most interesting vulnerabilities
which are critical vulnerabilities.
This usually includes remote code execution
or something similar.
So what you can also do,
you can click on them
and this is just what it managed to find
at this current point of scan.
So we got one critical vulnerability for now.
We got two mixed vulnerabilities,
one medium vulnerability
and some information disclosure right here.
Let's go back and we're going to wait for this to finish,
and once it's done
we will get back to it and see the results.
Alright.
It is finally over.
And we can see, if I click on the scan
that it managed to discover a bunch of vulnerabilities,
all kinds of them.
Let us go through these results,
and see some of the vulnerabilities it found.
Remember, we are most interested in critical
and high vulnerabilities.
Others can also be useful, but these two are the main ones.
First thing we see is that it managed to find
seven critical vulnerabilities,
11 high vulnerabilities,
36 medium vulnerabilities,
seven low,
and 148
information disclosure.
Let us click on the scan.
Right here we can order the vulnerabilities
by their severity.
So if I click on this arrow,
it'll go from the information to the critical,
but mostly we are interested in critical vulnerabilities.
So I will click it once again,
and let's go with any one of them.
We're going to see an example of each vulnerability.
We're going to check one critical, one high,
one medium, one low, and one information disclosure.
Let's go for example with this one.
So it says NFS Exported Share Information Disclosure.
This is a critical vulnerability.
Down here we can see the description,
and it says, "At least one of the NFS shares exported
by the remote server could be mounted by the scanning host.
An attacker may be able to leverage this to read
and possibly write files on remote host."
It tells us what is the solution to fix this vulnerability.
As it says, "configure NFS on the remote host
so that only authorized hosts can mount its remote shares."
Down here it tells us where it found the vulnerability.
It found it on our metasploitable
on the 2049 UDP port.
And what you would do for example,
is you would then google this vulnerability
which we learned in the previous video
where we covered Googling vulnerabilities
and search exploit,
and you would see how you would exploit this.
From now on, we know that this exists.
Let's check another critical vulnerability.
Let's go for example onto this one.
Bind shell backdoor detection.
It says, "a shell is listening on remote port
without any authentication being required.
An attacker may use it by connecting
to the remote port and sending commands directly."
Hmm, this seems like a really big problem.
And we are going to see in the next section
how we can actually gain access
from this critical vulnerability.
It is very, very easy, trust me.
But these types of misconfiguration happen often,
down here we can see the solution,
verify the remote host has been compromised,
and reinstall the system if necessary.
And the actual vulnerability is found
on the port one five two four over tcp.
Now since critical vulnerabilities are most important,
let us check another one.
Let's go onto this one.
VNC server password is password.
So it seems that we get to the default credentials
for some software running on our metasploitable.
As it says, "the VNC server running on the remote host
is secured with a week password"
and this type vulnerability is something
that you will find the most.
Now, it doesn't have to be anything connected
to the VNC server,
but weak credentials are something
that even the biggest companies have.
And you can have all the security in the world,
but if your password is weak,
none of that security will matter.
Down here we see the Nessus logged in using a password.
Password, and what port was it on?
It was port 5,900
over tcp.
So we'll see how we can exploit all of this
but let us also check
out some other vulnerabilities as well.
Apache Tomcat AJP connector Request Injection.
Let's click on it.
This seems to be a high vulnerability
and it tells us,
"A file read/inclusion vulnerability was found
in AGP connector.
A remote, unauthenticated attacker could exploit
this vulnerability to read web application files
from a vulnerable server."
It tells us that solution is to actually
upgrade the Tomcat server to the newer version.
And down here it tells us
over which port did it find the vulnerability,
which is port 8009.
On the right side,
we can also see some additional vulnerability information,
such as what is the vulnerability for,
it is for Apache Tomcat.
Is the Exploit available?
Yes, the exploit exists for this, and they're available.
The patch was published on March 1st, 2020,
and vulnerability was also published on that same day,
and Nessus managed to successfully exploit it,
Reference Information, and here are the vulnerability names.
So you would just type this,
search for an exploit for it,
and you would manage to exploit
the metasploitable machine.
Let's check out a few more vulnerabilities,
and then we are going to wrap up with this tutorial.
Let's go to a medium one,
and let's go for example
to this one.
SMB signing, not required.
Signing is not required on remote SMB server.
An authenticated remote attacker can exploit this
to conduct man-in-the-middle attacks against the SMB server.
Now we have not covered man-in-the-middle yet,
but later in the course,
we will be devoting an entire section
to this attack,
to the man-in-the-middle attack.
So for now, we just know that the SMB port,
which is running on port 445,
is vulnerable to the man-in-the-middle attacks.
Okay, let us also check out some information disclosure.
So right here we can see OpenSSL Detection,
Service Detection (GET request),
SSL TLS Versions Supported.
So we can check out
which SSL and TLS versions are supported.
This plugin detects which SSL and TLS versions are supported
by the remote service for encrypting communications,
and this port seems to be running SSL version two
SSL version three and TLS version one.
And these are just different protocols
used for encryption of the data
that is being transferred over this port.
And once again you will see
that SSL is vulnerable to the man-in-the-middle attack.
We can decrypt this data using that specific attack.
However, don't worry if you fully don't understand
what I'm talking about.
This is once again something that we will cover
in a later section.
Okay, great.
Do you see right now how amazing this Nessus scanner is?
It literally gave us most of the vulnerabilities
just from a single scan.
In next section, we will see how to exploit
most of these vulnerabilities on the metasploitable,
but on other targets as well.
In the next video,
we're going to scan other machine
using Nessus,
and we're going to see what results we get.
See you in the next.