-: Okay, now that we installed Nexpose successfully,
let's see how we can run that tool
and see what that tool is.
I know we spoke about it a lot
and we went through the installation process,
but you still haven't seen what the tool does.
So this is the homepage of the tool.
And, as you can see now, everything is empty.
So, before I start talking about what everything means,
let's go ahead and add the target
and then we'll do a test and we'll see,
'cause this stuff will be filled after we do a test.
So the first thing I'm gonna do is go on Create
and go on Site to add the target.
And I'm gonna call this target "metaesploitable",
and I'm going to go to the assets
and we're gonna add the target.
So the target can be arranged the same way we added it
when we were doing the network penetration part
of the things with Zenmap.
So you can add the range or you can add a specific IP.
So in this, we're actually targeting
the Metasploitable machine.
So we're going to add our target,
which is 10, 20, 14, 2, 0, 4.
Confirm this here. This is our Metasploitable machine,
10, 20, 14, 2, 0, 4.
And we're gonna add this to a group
and we call that "metasploitable" as well.
And we call this "test".
So this is our group name.
Now, here in the authentication part,
if the target uses some sort of authentication,
so nobody can access the target,
unless they need to authenticate
with some sort of a service.
For example, if it's an FTP service
or a web http authentication,
a TELNET or an SQL server.
So you can pick it from here,
put the domain, username, password, confirm your password.
And that way the framework would be able to authenticate
with that service and test the security of your server.
Now, our server doesn't use any type of authentication,
so we don't need this.
Also, if you're targeting a web application
and the web application has a login page, for example,
for users, for example, Facebook.
Let's say you're targeting Facebook.
Then you won't have access to most of Facebook's features
unless you log in with using a certain username
and a password.
So again, using this feature here,
you can log in and then test the security of your target.
And the Templates is, where you select the scan type.
So it's very similar to the scan type with Zenmap.
We've seen in Zenmap, we had a quick scan,
quick scan plus, and intense scan. This is the same.
So each one of these profiles is different.
It scans different things.
For example, we have the full audit here,
which takes a lot of time,
but pretty much checks for everything.
Then you have a full audit enhanced logging
without Web Spider.
So a Web Spider is a tool or a script
that finds all the files and directories in your target.
And the default one is a full audit without Web Spider.
So that's the one we're gonna be doing.
And you also have network specific profiles.
You have web audits as well.
So I really encourage you to try all of them or most of them
and get yourself familiar with them.
Now we're only gonna try this one
because using them is the same.
Which will be scanning for ICMP, TCP and UDP ports.
So I'm leaving that the same.
I'm gonna leave the engine the same as well,
which means it's going to use our local engine,
which we installed instead of using
the one that is provided by Rapid7.
And the alerts, you can set up custom alerts.
So that's when a vulnerability is found,
you get a notification.
And the schedule is a really, really cool feature.
Now, say you're working for a company or for an enterprise
that keeps pushing code, new code every day.
Or for example, maybe your code,
you do a test today
and everything you're working on is good.
Your web servers, your programs, your applications.
Everything is up to date
and there's no vulnerabilities in them.
Let's say tomorrow you push a new vulnerable code,
or maybe tomorrow someone discovers a new vulnerability
with a program that you're using on your web server.
So you're not secure anymore.
So this feature allows you to schedule this test
so that it runs every week or every hour or every month,
depending on how critical it is.
So all you have to do is just go into create a schedule
and create the schedule,
so you can put a start date and an end date,
and you set up the frequency from here,
for every day, every Thursday, every 26th,
or depending on what you want, really.
You create a schedule and then every interval
that you specify, the scan will run.
And even you can get it to produce a report for you.
So you can go over the report and see what's changed
or what has been discovered.
So everything's good, now.
The most important part today,
or what we did here is you put your target here.
And the next thing is you select the template.
So we have both of them selected,
and we're gonna do save and scan,
which will save this configuration and start a scan for us.
Now, as you can see, our asset discovery is in progress.
I'm gonna pause the video.
And after that,
we will talk about the results that we got.