Instructor: In this lecture, we're gonna talk about
a really cool tool called Nexpose.
This is more of an enterprise tool that is designed
to be used in large companies and organizations.
It's basically a vulnerability management framework
made by Rapid7. So the same people that made Metasploit.
It comes with a really nice web GUI.
And what I mean by a vulnerability management framework
is that it's designed to cover the whole life cycle
of vulnerability management.
So it can scan for open ports,
it can discover running services,
find vulnerabilities in the services, find exploits,
whether you can exploit them in Metasploit
or if there is a different way of exploiting them,
give you the resources to do that,
verify that these exploits exist, and even generate reports
to detail everything that it discovers.
It actually generates two sets of reports,
a technical one, for the technical people,
and a high-level report,
to share with less technical people,
such as admins and managers.
You can also use it to automate these scans
so that you can run specific scans
that you configure yourself every certain period of time.
So as you can see, a really cool framework
with a lot of really useful features,
but most of them would only be useful
to big enterprises and companies,
especially considering the price
and the resources this program requires.
So it's very resource hungry,
it needs a minimum of eight gigs of memory
and a lot of storage.
But don't worry about that
because we're only gonna use this in one lecture,
the next lecture, just to show you
what to expect in an enterprise environment
where you'd be running such tools.
And that's why you actually don't need to worry
about the resources,
because if you ever needed to use this type of software,
the company that you're working with will provide it
and will provide the needed infrastructure.
So if you can give Kali eight gigs of memory,
then go for it and test it,
as I'm gonna show you in the next lecture.
If you can't, then that's fine, just watch the lecture,
and you're gonna get a good idea
on how to operate these kind of tools.
So, first of all, you're gonna need to download Nexpose.
It's not installed in Kali.
There is a link for it in the resources of this lecture.
Make sure that you use a company email.
If you don't have one, use the link in the resources as well
to get an email that looks like a company email,
because they're gonna send you a verification code to that.
Once you have it downloaded...
I have it right here already in my downloads.
I'm gonna navigate to my download directory
from my terminal.
So we're gonna do cd, Downloads, we're gonna do ls,
and we can find it in here. This is the installation script.
Now, before we run this, this is a binary executable,
we're gonna have to change its permissions to unexecutable.
And to do that, we're gonna do chmod, +x,
followed by the file name.
Now if ls, you'll see it's gonna be listed in green,
which means that it is unexecutable
and therefore we'll be able to run it
by doing ./ followed by the file name.
We're gonna hit Enter, and this will show us
a really easy-to-use installation wizard.
So we're gonna click on Next.
We're gonna keep this at the first option
to install the console and the scan engine.
You can modify the installation directory in here,
but we're gonna keep it to the default.
We're gonna hit Next.
Now it's given us a warning, as you can see,
saying that 80 gigabytes of storage is recommended.
This is not necessary.
It's simply saying that you could use a lot of storage
if you continue using the program.
But for testing purposes, what I have right now, 56,
is more than enough, so we're gonna continue.
And this is just the checklist to make sure
that you're meeting the minimum requirements.
The main one is the amount of memory I assigned to Kali.
As you can see, it has 10 gigabytes of memory,
because like I said, the minimum is eight.
We're gonna click on Next.
And we're just gonna fill this with my information.
So we're gonna put my first name, my last name,
company name.
We're gonna set a username, we'll just set it to Zaid,
and we'll put a password,
and we're gonna click on Next.
Now it's just giving you a summary
of everything that we set so far.
The main thing you wanna make sure you do
is to uncheck this box. So it's already unchecked.
If you check it, the program will automatically start
after you finished the installation.
But like I said, it's a really huge framework
and I'd rather start it manually,
and I'll show you how to do that later on.
So we wanna make sure that we do not check this box.
We're gonna click on Next,
and it's gonna start installing this framework for us.
So I'm gonna pause the video and resume once it's installed.
Perfect, now the installation is complete.
The only thing that I wanna modify right now is,
as you can see in here,
it saying that the console is configured
to automatically run at startup.
I do not want this to happen because like I said,
we're only gonna use this in one lecture.
Therefore there is no point of this software starting
every time we start our Kali Linux.
So I'm gonna click on Finish.
And what I'm gonna do now is disabled the auto start
of this program, of Nextpose.
So to do that, we're gonna do systemctl, disabled.
And we're gonna follow this by the name of the service
that we want to disable.
And as mentioned in the previous message
that we got from the installer,
the name of the service is nexposeconsole.service.
We're gonna hit Enter, and as you can see, it's saying that
it removed it from the auto start.
So now if we reboot our Kali and restart it,
the Nexpose console will not be automatically started,
which is exactly what we want.
So now that we installed Nexpose,
let's see how we're gonna start it.
So I'm gonna clear the screen.
And starting it is actually very, very simple.
First, we're gonna navigate
to the location where we installed Nexpose.
So as we seen during the installation wizard,
this is installed in opt/rapid7/nexpose/.
Now we're gonna list the directory is in here,
and the start-up script is stored in this directory.
So we're gonna navigate to it as well.
So we're gonna do cd, nsc.
And if we list all of the files and directoris in here,
you'll notice that we have a file called nsc.sh.
This is the start script for Nexpose.
So I'm gonna maximize my terminal
and we're gonna do ./ followed by the name
of the script that we want to start, which is nsc.sh,
and we're gonna hit Enter.
Now if you read the wizard, it actually said
that starting Nexpose could take up to 30 minutes.
And in my case, sometimes in other older computers,
it took up to 40 minutes
to actually initialize this framework.
So you wanna be very patient with this later on,
and you wanna make sure you have 10 gigs of memory,
like I said, and you will know when it's done,
because you're gonna get the URL
that you can use to access it.
So I'm gonna pause it and we'll resume
once it's fully initialized.
Perfect now because we don't see any errors,
and because we see this message, telling us
that we can actually access Nexpose through this URL.
That means everything has started successfully.
So we can actually just control and click it
to open it in our browser.
And as you can see, you're gonna get a warning
because you're loading this over HTTPS
and Nexpose is using a self-signed certificate.
So all you have to do is click on Advanced
and accept the risk,
because this is running on our own server.
So we know this is fine.
And as you can see, now we're getting the login screen.
So I'm gonna log in using the same information
that I used when I installed Nexpose.
So my username was Zaid
and the password is what I set it to, gonna hit Enter,
and perfect, as you can see we got the console.
Now the first thing it's asking me for
is the activation key.
You should receive one on your email in your inbox by now.
I already have it,
and I already have it copied in my clipboard,
so I'm just gonna paste it here, and click on Activate Key.
Give it some time to activate the key.
It actually could take a few minutes, again.
Now, perfect, as you can see,
it's saying, "Activation successful."
So we're gonna click on OK, and that's it.
Now the framework is ready to be used,
and I'm gonna show you how to use it exactly
in the next lecture.
But like I said, that would be the only lecture
that we're gonna be using this framework.
I'm only showing you how to use it now,
just to give you an idea of this type of software.
But if you can't install it on your computer,
that's completely fine
because we're not gonna be relying on it
in the rest of the course.