Instructor: Okay, my scan is over.
And I'm here now at the assets page.
And as you can see that we have one asset.
Has been scanned.
We can see that the asset is running Ubuntu
and the skills that you need
to hack into this asset is novice.
Now already from this you can see that Nexpose
show us much more information than Metasploit Community,
and it's a much more advanced
vulnerability management framework.
We can see that we scanned one target,
it's Metasploitable, and the site is Global.
Let me zoom in.
It's running on Ubuntu Linux 8.04.
We discovered no malware and 177 exploits,
308 vulnerabilities.
Remember with Metasploit Community,
I think we only only discovered eight,
only one exploitable vulnerability,
and eight modules that can be used.
Here we discovered 308 vulnerabilities,
so it's covered so many more vulnerabilities and exploits.
You can see that there is a risk factor assessed to this
and the last time that the scan was done.
Now if we go down we can see that the operating system
that we discovered again, it's Metasploit.
We can see the software that is installed
on the target computer.
So not only the services that's running on ports,
we can see actual software installed on the target computer.
This can be very useful after we have the computer,
so after we've managed to hack into it,
it's very useful to find local exploits
that can be used to increase our privileges,
for example, if you got a normal user
and you wanted to become a route, then you can use
a local buffer overflow to increase your privileges
or to do other kind of stuff.
So these are very useful in terms of post-exploitation.
If we go down, we'll see the services that's installed
on the target computer.
Just like UNMAP gave it to us,
we can see that HTTPs running,
DNS, and so on.
If you click on any of these services,
you'll see that it'll give you more information about it,
for example it's a HTTP service, a description about it
and the ports that it's running on.
So we can see that HTTPs running on port 80,
and on port 8180.
Now let's go up.
And if we wanted to have a closer look
on the vulnerabilities,
we can go to the vulnerabilities page here.
And you can see we have a graph here
about the vulnerabilities,
categorized based on their risk factor.
And here they're categorized based on the skill level
needed in order to exploit these vulnerabilities.
And in here you can see a list of all of them
and we can switch between them using this right here.
Again, this, if there is any malware,
you'll see it in here.
And if there is an exploitation you'll see it in here.
Now all of these top vulnerabilities here
don't have an exploitation using their tool
but they are ordered based on their risk.
So these are very risky vulnerabilities
and then as we proceed through them,
the risk will be a bit less.
So you can see here I discovered that VNC password
is 'password', so we can go in and try to connect using VNC.
Now VNC is a service very similar to Remote Desktop,
basically it'll show you the desktop
and it'll allow you to gain full access
to the target computer, just like Remote Desktop.
I'm not gonna show you how to do that, very simple.
Was telling you here, the password is 'password',
now it's also telling you that there is a backdoor running
and we used that already.
It's telling us that it's running an old version of PHP
that can be exploitable, just an old version actually.
Now let's look at something that can be exploitable.
So I'm gonna click on this to order them by the exploit,
and you can see that all of these have an 'M' logo,
which means that they can be exploited using Metasploit.
You can see here we have the remote shell service
that we use, and there is the rlogin service here
that can be used as well, that we already had a look on.
So let's click on something that we haven't seen before.
And here you can see a description of this vulnerability.
Again, you can see the port that it's running on.
And you can see why it thinks that this particular target
is vulnerable to this exploit.
If you go down, it'll show you how you can exploit it.
So there's three different modules
that can be used to exploit it.
But it doesn't really have to exploit it,
sometimes you just see modules that can be used
to verify the existence of this exploit.
But basically these are modules associated with it.
And if we click on this it'll take us to the Rapid7 page
that we always use to see when we Google stuff.
And we see the module name where we can just copy
and paste it in Metasploit and it shows the options
and then use this exploit the same way that we seeing it
in previous videos.
Again when you go down, you'll see references to this,
to this particular exploit.
And at the bottom it'll show you the solution
on how you can fix this exploit.
So for this one, all you need to do
is just change the administrator password
and not use the default configuration.
Another useful thing is the reports.
So this framework allow you to generate reports
for each scan that you do.
And there is different types of templates for the reports
so if you go on Create Report,
you can see that there is an audit report
that contains a lot of information, detailed information
for the programmers or for the technical people.
Or you can use an executive report
which has less information and it's made for the managers
or for the top level people that don't have much experience
with technical stuff.
You can select any template you want, call it anything,
so I'm gonna call this 'Metasploitable' or 'Metasploit'.
And you select the format that you want,
so it's set to PDF here.
Then I'm going to select the target scan
that I want to generate the report for,
and I selected my Metasploitable.
And then you save, and run the report,
to generate the report.
You can also get this to generate reports automatically
every time, 'cause as I showed you,
you can schedule reports, you can schedule scans,
and you can also schedule an automatic report
after each time a scan is done.
So for example, if you're scanning every week,
you can also generate a report every week,
every time that scans done.
Now let me just download the report and show you
what it looks like.
As you can see it has the date, it has the title,
it has all the exploits that have been found.
But this is the executive report so it has small details
about the exploits and more graphical stuff
to show the executives the risks that has been found
and how critical they are.
So as you can see, Nexpose shows you much more detail
and it's much more advanced.
It's directed towards bigger companies,
bigger infrastructures, where you need to always make sure
everything is up to date, and everything is installed,
and does not have any exploits.