‫Let's perform another vulnerability scan.
‫I want to perform an aggressive scan to find as many vulnerabilities as possible.
‫Go to Cali and start the Nessus demon if it's not already started.
‫You service NASA's status to learn if it's running.
‫OK, so it's inactive, so I use service necessity, start to start and as a service.
‫Now, go to your browser and connect to the Nessus interface.
‫It is a TDPs service is running on the same machine, so I'll use 127.0.0.1 loopback IP address referred
‫to as localhost and the Port of Vanesa service is a for.
‫Sign in using your credential.
‫Click the new scan button now, let's choose advanced scan for this scan.
‫We'll be more aggressive than a basic network scan.
‫So enter the basic info, give the scan a name and enter a description if you want.
‫And the targets.
‫Here I have a Windows XP with an IP address of two 07 and Metasploit able to Linux system with an IP
‫address of two zero six.
‫You know, I have a third system and up to date Windows eight, and its IP address is two to three.
‫Right, so back to Cali and enter the IP addresses of the target systems.
‫Two zero six four Metis voidable two zero seven four Windows XP and two two three four Windows eight.
‫Now click Discovery and the list of the left.
‫So we're simply going to accept the defaults on this page, so let's click on assessment over to the
‫left.
‫And on this page, we want to check perform thorough tests, so check the box.
‫Then moved to the report section in the options on the left.
‫You can override the normal verbosity, make it report as much info as possible.
‫So next, click the advanced option in the left to the left.
‫The only thing we're going to do here is uncheck enable safe checks.
‫Now on a normal production network, you would leave this box checked.
‫You don't want to take down production systems when scanning.
‫But for our purposes here, we want to gather as much information as possible, so we're going to check
‫it.
‫Now, click on the Credentials tab.
‫Select the SSA option.
‫In the list on the left.
‫Now, since we know the username and password for the Metasploit LVL two machine, we're going to put
‫those credentials in here.
‫Remember, the username and password are both massive admin.
‫James, the authentication method to password and put it in the username and password below.
‫Now in the plug ins tab.
‫We only need to activate the plug ins that have to do with what might be running on a Linux system so
‫we can disable a few things here.
‫OK.
‫I paused demo here, I've got to make an apology.
‫It's a late update while capturing the demo.
‫I forgot that I have Windows targets and disable the Windows plug ins.
‫It's a mistake and I just wanted to show you that what we do here is if there's a problem, there's
‫always a solution.
‫So if you have Windows targets, please do not disable the Windows plug ins.
‫All right, let's move on, we can finally click Save at the bottom.
‫So here's the scan and we're ready to run it.
‫Simply click the Great Triangle at the far right of our scan, which stands for launching the scan.
‫And yes, the scan is started.
‫Now you can pause or stop the scan any time you want.
‫So click the scan and we see the results in real time.
‫OK, boy, that's going to take a while to run, so it's probably a good time to check your email.
‫Grab a cup of coffee, maybe, but just make sure you come back to review the results.