‫At last, we are ready to start and this is vulnerability scan.
‫This is the main page of the Nessus Web interface.
‫We are in my scan section of Scans tab.
‫At the upper left corner, click new scan.
‫First, neces asks for the scanner.
‫We have seen them before.
‫So here we can choose the most suitable one for our skin.
‫But in the home version of NASA's, unfortunately, some scans are disabled.
‫If you click internal PCI Network Scan, for example, the application redirects you to the Nessus website
‫to buy Nesses Pro. There are also available scanners like Basic Network Scan or alternatively go to
‫user defined tap and select your own policy.
‫This is the policy we defined in the previous lecture, so I chose this now given named your scan.
‫As you can see in the right side of the name field, the required fields are identified by neces.
‫So, right, description if you want.
‫Select the folder for the output and define the target.
‫You can list the hosts in target field one by one.
‫I want to scan my two systems now.
‫Nine nine one three nine is OWASP A.
‫And nine, nine, two zero six is my Metasploit BBL system, so if you want a multiple IP addresses.
‫Just put a comma in between them.
‫You can also define an IP block or a range.
‫Just as you remember, the map lectures or alternatively, if you have a file that contains a list of
‫the hosts that we also covered earlier, you can have that file using the add file link in the upload
‫target field.
‫So now we're ready to launch the scan at the bottom of the page.
‫Select Save or click the Down Arrow button and select Launch to start the scan immediately.
‫I choose Launch It first, save the scan and then launched immediately.
‫So while scanning, let's see some of the parts of NASA's interface.
‫At the left, do you see the folders next to my scans folder?
‫It says that I have one active scan and in my scans page you see the scan that we just started.
‫If you click on it, you see the scan details.
‫There are three tabs here, hosts vulnerabilities and history.
‫When you click on the Vulnerabilities tab, you see the vulnerabilities found during the scan here,
‫we already have some results.
‫Now, click the Hosts tab to turn back.
‫These are the systems that we defined as targets OWASP, CWA and Metasploit at the right, you see the
‫severity levels of the vulnerabilities.
‫NASA's classifies vulnerabilities into five levels.
‫Informational level quickly identifies non vulnerability information, which is, well, nice to know
‫and separates them from the vulnerability detail, which is need to know, right?
‫Low level identifies a flaw that might help an attacker to better refine his attack, but by itself,
‫that flaw won't be sufficient for a compromise.
‫Medium level identifies it.
‫Some information is leaking from the remote host.
‫An attacker might be able to read a file he should not have access to high level identifies.
‫The attacker can read arbitrary files on the remote host and or can execute commands on it, and critical
‫level vulnerabilities are the most important vulnerabilities for us.
‫These vulnerabilities can be exploited by a tool, and in most cases, the attacker does not need to
‫make an extra effort to exploit them.
‫So let's fast forward with the scan.
‫Now, on the right side of each host row, you can see the status of the scan of that host.
‫One hundred percent means the scan of that host is complete.
‫Did you know you can ping the host sometimes to understand that they're still alive?
‫And finally, our scan is completed in four minutes, which is a very fast scan for a vulnerability
‫scan.
‫Now, let's collect the Metasploit able to go to the vulnerabilities of that host.
‫Here are the vulnerabilities of the Metasploit machine found by this scam.
‫Please note that there might be other vulnerabilities that cannot be found by NASA's with the policy
‫that we used.
‫The vulnerabilities are ordered by severity levels by default, and I think that's a good idea.
‫The vulnerabilities in a critical severity level are the most important ones for us again.
‫So click on a vulnerability to see the details of it.
‫So here we have the name of the vulnerability.
‫A brief description.
‫A solution method and the links to learn more about it.
‫And last.
‫The host and the port where the vulnerability lives at the right side of the screen, you see some additional
‫and important information about the vulnerability.
‫So for this particular vulnerability, Nessa says that we can exploit it using core impact, which is
‫a commercial and very powerful exploitation tool.
‫And here are the scores of this vulnerability, 10.0 is perfect for us.
‫So click back to vulnerabilities.
‫You go back to the list of the vulnerabilities here, there is another vulnerability which says the
‫DNC server is running on the host and its password is password.
‫If that's true, and if there's no additional measure to protect the host, we can access that host
‫very easily.
‫I'll show you.
‫Let's test it.
‫Go to the terminal screen and run the VNC viewer by typing ex-fiancee, viewer and hit Enter.
‫If you don't have the RNC viewer installed on your Carly type APT, get install x, v and C viewer and
‫hit enter.
‫Take the IP address of Metasploit, Obel as the VMC server and hit enter.
‫And our type password as the password and hit enter again.
‫And voila, we are in the system.
‫I use the warming Linux command to learn the user that I've caught.
‫And you name that A.
‫To learn the operating system and the kernel details if config to see the information about the network,
‫interfaces, cetera.
‫Now, type R.M. Dash RF slash.
‫No, no, no, no, just kidding, don't don't do that.
‫Don't.