Hang on before rushing in to start our first Nessus scan. I'd like to show you how to create our own
policies.
Policies allow you to create custom templates defining what actions are performed during a scan in the
Nessus web interface
click "Policies" at the left side.
You see that. Good. Click the "Create a new policy" link inside the Policies page.
Now here we have a lot of scanners.
So in "Advance Scan" all the options are chosen by us without any guidance or recommendation.
"Basic Network Scan" is generally suitable for any host. "Internal PCI Network" scan is designed for internal
scans. And it's based on PCI DSS standards. PCI DSS, Payment Card Institute and Data Security Standards.
Simply one of the most important information security standards.
So it looks like the days when this video was captured that Spectre and Meltdown are the really new
vulnerabilities.
So here there is scan specialized for Spectre and Meltdown vulnerabilities.
This clearly shows how up to date Nessus is.
Here there's another scanner specific for web applications.
So let's configure our own scan. Click "Advanced Scan". First, give a name for your policy.
Now go to "Discovery" section.
So we're in the "Host Discovery Page".
Here we have a "ping the remote host" option and the settings of the ping.
If we're going to use the data we collected with Nmap we can close this ping scan because we already
have the lists of the hosts. Click "Port Scanning" to configure port scanning options.
The default value of the port scan ranges, well, default.
That means Nessus will scan the ports which is in its nessus-services file.
Now I go to the terminal screen re-analyze and nessus-services file.
Let's find the file first.
Use the "find" command to find the file.
/ means that the search will begin from the root directory. "-name" shows the name of the search file
and hit enter.
And here it is.
You can stop the search using “ctrl + c” keys
I use "less" command to see the content of the file. Here are the ports, protocols and the default services
which use these ports.
I want to see the number of the lines of nessus-services file to understand how many ports are scanned
by default. "Cat" command with a file name, pipe, type "wc" to see the word count. The first number
is the number of lines, a second one is the number of the words and the last one is the number of the characters.
So, we can say that 9,000 ports are scanned by default. Which is the total of both TCP and UDP ports.
But what if you want to see the number of TCP ports scanned by default. You can use "grep" before "wc" type
“cat filename | grep tcp | wc” .
You will see the number of TCP port scanned by default.
There are about 4600 TCP ports.
If you want to scan all ports, you should type 165535 in port scan range field.
So here are the options to use SSS service for local port enumerators.
So let's have a short break here.
If you have some credentials to scan some services in depth you can define those credentials before
the scan.
So here select the "Credentials" tab and you see some services when you click the "SSH", for example, you
will see the credential options. But let's remove this for now.
Now turn back to settings by clicking its tab.
We were in discovery port scanning page and here the port scanning options. SYN scan is selected
by default.
If you like you can select TCP and/or UDP scans as well.
Now go to the "Advanced" section.
Safe checks are enabled by default so we can select "Scan IP addresses in a random order" to make the
scan a little more stealthy.
Let's look at the performance options.
We can reduce the number of Max simultaneous host per scan to avoid delays and network traffic max number
of concurrent TCP sessions per host is not defined by default.
We can define an upper bound to keep the hosts safe.
And again we may define a maximum number of concurrent TCP sessions per scan to keep the network traffic
safe.
Now look at the tabs on the top of the new policy page and you'll see the "Plugins" tab.
Right so here we have tons of plugins used in Nessus scans.
If you click one of the plugin families you'll see all the plugins of that family.
You see the total number of plugins that are plugin family and here are the plugins.
You can click on "enabled" next to a plugin to disable it or if you want to disable an entire plugin
family entirely, for example, denial of service click on "enabled" label next to the name of the plugin
family. Click "Save".
And now we have our own scan policy.