Hey, everyone, welcome back to the
course. So in the last video, we
went ahead and logged in Kelly
Linux, we then also created
our text file with our NATO
command and then we went ahead and
loaded IP addresses in there so we
could actually scan against those.
And then we wrapped up that video
with launching the open vast
tool. And we were in the process of
launching it. On one hand, pause
video, as I mentioned, it takes
several minutes to go ahead and
launch it.
Once it does, it will launch
Firefox, as you see in the
background there, and it will take
you to the Green Zone security
assistant login page right here in
step 16.
So you'll see that in the background
there in my machine.
Now, we're at step 17 here.
We're going to go ahead and log into
this particular page.
So we'll login with the username of
Admon. And then the password is
Capital P, the at symbol
and then lowercase SSW,
the number zero and then
lowercase R d.
So let's go ahead and type that in
now. So we're going to type in
admin, all lowercase
and then we'll type in our password
here. So capital P the at
symbol lowercase ssw
the number zero and lowercase
r d once you touch that and
you can either hit enter your
keyboard or just click on log in
there and may ask you, do you want
to remember. It doesn't matter.
Then just go ahead and out or you
can remember it, it has no
bearing on the lab at all.
So you're welcome to do what you
want in that particular situation.
Or so the next step here, step 18.
We're going to go ahead and put our
mouse over top of the configuration
option and then select targets.
So this one right here in the
center.
It's.
All right, so it takes us to our
target page here.
So now what we're going to do is
we're actually going to look this
tiny little icon here that looks
like a little white star.
So it's a small blue colored button,
as I mentioned, with a white
colored star in the center.
So we're going to go ahead and click
on that.
And that's going to allow us to
create a new target. So it's
actually going to open a pop up box
for us when we do that.
So go ahead and click on it.
You'll see here in a second.
It opens up this paper box for us
and we'll go ahead and get some of
these fields filled out.
All right. So first thing we're
going to do here is step one.
We're going to go ahead and in the
name box type incorporate devices.
So this top box here, just
go ahead and type in corporate
devices.
And then in our comment field, we're
going to type in. These are devices
on the network. You don't need the
quotation marks.
I just wanted you to know that was a
basically a statement there.
So these are the devices.
These are devices on the network.
So go and type that in the common
box.
These are devices on the network.
All right, so
now what we're going to do on step
23 under the hosts
of this this third
option down here, we're going to
select the from file option
and then we're going to go ahead and
browse.
So we've went ahead and we select
the from final option.
We're browsing now.
You'll see it's open a window in the
background there.
What I want you to do now is click
on the student folder.
So it's down here at the bottom left
hand. Click on that.
And then now you're going to see the
file that we created, a scanning
target list one.
Go ahead and click on that one
and then select the open button.
All right. Let's go back to our lab
document.
So we've gone here and we took the
student folder. We clicked on the
file that we had created and we
select the open button.
So our last step at this particular
screen is going to be clicking on
the create button at the very
bottom. Right. So let's go and do
that now. Click on that.
Closed a little pop up for us
or let's go back to our lab
document.
All right, so our next step here is
step 29, we're going to go ahead at
the very top of the screen here.
We're going to click on and we're
going to cover our mouseover over
top of the scans option
and then we're going to select TASC.
So it's going to do the analysis
scans and then you're going to see
TASC, right. They're going to go
ahead and click on that one.
You might get this little pop up
here. If you see that, you can x out
of it or you just wait until that
time runs out either way to close
it. So I'm just going to X out of it
to save us some time there.
A couple of seconds.
So you'll see step 30.
That was a little paperbarks again.
You can just leave it alone for like
six or seven seconds and it will
close for you.
The next thing where you were to
click back on these small blue
colored button again, that's that
same one with the whites are in the
center and we're going to select new
task. So let's go and do that now.
So you'll see if I hover my mouse
over top, it gives me a new task
option. I want to go ahead and click
on that and you'll see
it open up some more fields for us
to fill out.
So we're going to type in the name
field. We're going to type corporate
scan. So let's go and do that now.
So it's top on here.
What is going to type in corporate
scan?
And if you remember in the last one,
we typed in corporate devices.
So now we're just going to specify
that, hey, this is a corporate scan
is associated with those particular
devices.
All right. So all we're going to do
there is actually change the name.
We're just going to now click the
button at the bottom. Right.
So let's go and do that.
And what you'll see here in a second
is you'll see a line here
with our scan.
And the way we go ahead and start
our scan is this little.
The white arrow in it, you'll
see if I have my mouse over top, it
shall start and then we're just
going to go ahead and start that.
Now it's going to go ahead and run
the scan
in the background there.
Now, it may take five to 10 minutes
to complete.
The next thing I actually want you
to do while it's going going ahead
and running is up here at the top
where it says no auto refresh.
Go ahead and just click on that box
and then choose refresh every 30
seconds. So that way, as it starts
to complete, you'll start knowing,
like, OK, it's almost complete and,
you know, to be able to come here
and click on it.
Now, as I mentioned, the scan is
going to take about five to 10
minutes to complete.
So I'm going to go and pause video
here once it completes on my
end or go ahead and pick back up the
video. And what you'll notice once
it's completed is we'll see a date
here that we can go ahead and click
on.
All right, so it's finished scanning
finally now, moving through a couple
of error messages, so that's what
kind of took so long to come back on
the video.
So basically, as it was scanning, it
would throw in air.
If it does that, I forget the exact
air code, but just click the
browser back button and that will
take you back to the scanning
page and eventually should finish
successfully.
Not like I said, just take a moment
or so to get finished out, but you
eventually should see it finished
and then you'll want to click on
the last page should
be available pretty click on.
Now, if it's not for some reason,
just go to scans and then TASC
basically that should try to refresh
it and then you should be good to
go. The ultimate goal is to get
here where we have
a listing of all the vulnerabilities
that is found. Now, the cool thing
about this and
for that, I want
you to answer question one here.
So what vulnerabilities do you see
on the report, if any?
On my end, obviously, you can see
there I have quite a few
vulnerabilities.
And then, of course, number two kind
of ties into what I was about to
mention, what other information is
provided in the report besides just
listing out of vulnerability,
what other information is available
for us now on your
own? If you want to go in the video,
look through all of these items
that you find.
So feel free to look through all of
them, go through different pages, et
cetera,
and jot down what information you
see. So, for example, here we see we
do have a severity level.
So 10 being the highest, 10 out of
10, not a good thing by
any means.
We've also got the
IP address here as well
as the port that
we're running on.
And then if we open these up, so
we'll go ahead and click click on
the stop on here.
It's going to tell us some information
about that particular vulnerability
that we're finding. So tell me tell
us the key codes, if
there are any. Assuming so, there
should be.
It also tell you some other
supporting documentation or websites
that you can go to to find out more
about it. And it also, as I
mentioned, gives you kind of a brief
summary of the particular
vulnerability.
All right, so the last step of
related documents is basically
generating a report,
and this is something that like if
you were trying to give it to your
boss or whatnot, this is
something that you would want to go
ahead and do.
So I'm just going to back up here,
so I'll go back to my main list
there. Now, the way we get a report
is here in this top left little
drop down menu.
We're just going to click on there
and we're going to scroll down and
choose PDF.
And then this little down arrow
right here, that's actually how we
generate a report.
So the download filter to report is
the name of the option.
If we go ahead and click on that,
it's going to give us a pop up box
here and then we can either save or
open the report.
It has not been opening for me in
the lab here, so I just been saving
it. It's kind of a proof of concept
thing. But again, in the
real world, you just download this
and open it up and provide
it to whoever needs it.
But the main thing I want you to see
after we ran open was, you know,
close out.
The main thing I wanted to see
wanted you to see here is
how much information Open provides
back to us compared to the core
impact, you know, the free scan that
we ran earlier.
This one's an open source tool.
And look at the information.
You know, it gives us the severity
level. It gives us some
information of location information.
And then if we click on it, it gives
us a description, et cetera, of that
particular vulnerability.
So in this video, we just wrapped up
our discussion on open source.
Again, that's a vulnerability
scanning tool and one that's
commonly used in the industry by
defenders as well as attackers
in the next module.
We're just going to go ahead and
wrap up our discussion for the
entire course.
Now, keep in mind as well that there
are assessments for this course.
Be sure to download the supplemental
resources section so you'll get all
this lab Step-By-Step Guides as
well as the assessments.
And so what I've done there is I've
listed out the assessments you need
to complete, sort of listed out a
bunch of different map commands that
I want you to run, listed out the
lab you should go into to run those,
as well as an assessment from
Sadef on our site.
That's for vulnerability
assessment, so to speak, of finding
vulnerabilities. So I want you
to copy all of those as part of the
kind of the capstone, so to speak,
of the course, and then moving to
the conclusion video where we kind
of wrap things up.