There are many tools that can be utilized for asset
management for auditing.
We're going to talk about one, Nessus by Tenable.
There is a Essentials which is free and anyone can use it.
There's also Home, and Professional, and Enterprise.
We're going to take a look at just the Essential one.
Nessus runs off of a server.
In this case, it's hosted locally,
but we're going to be reaching out
to another machine on the network
and scanning that machine.
Just to explain, our IP is this 192.93.34.2.
And we're going to be working with demo.any.local.
You can see there that that's the .3.
It's another machine on the network.
So we log in to Nessus.
And we're going to tell it the demo.any.local.
And you could put in an IP address.
You could put in a range.
You put in a whole network.
In this case, we're just going to put in the domain name.
And it ran a scan, a discovery scan,
and found this IP address, which is what we saw down there.
It did the same thing we did.
And now it's running a basic network scan.
All that's running-- you can come take a look.
There's this my host discovery scan.
If we really wanted to dig in--
it did a WHOIS request.
And we can see some version information for Nessus.
Go right to the scans and the basic network scan
is still running.
We can take a look at what it found.
It ran a SYN scanner, a port scanner.
It did a host fully-qualified domain name resolution,
not too crazy.
For these vulnerabilities, you can see severity.
It just says info.
So while it's under vulnerabilities,
these don't actually have anything
that we need to worry about.
You can see the categories over here
go from low, medium, high to critical.
We have more coming in, found 17.
Again, all of these are just info that it ran scans
and it found things, not necessarily that they're
good or bad.
It just found a lot of things.
Now, simple auditing, you would want to see and compare
what do we know about the system?
Does this match what we have set?
If you're going into a pen test with information given to you,
maybe like a gray or a white [INAUDIBLE] test,
then you would also want to compare those things
because your findings really need to reflect
what's useful to your customer.
Here we can see a medium.
And it's based on the version of jQuery,
and it might be vulnerable.
Two multiple cross-site scripting vulnerabilities,
that's not a great thing.
We don't want that.
If we can stop it--
sorry, basically [INAUDIBLE].
It came across two of those.
Yeah, it was off [INAUDIBLE],, it looks like, not too crazy.
We could take the results of our scan
and we could go here to report at the top right.
And we get export--
let's make this full screen--
as a PDF, HTML, or a Comma Separated Value, CSV file.
It's an Excel file.
But not in an iso fun way.
[INAUDIBLE] detail vulnerabilities by host,
vulnerabilities by plug-in, or all vulnerability operations.
We're going to run one more scan.
Go back here to my scans.
And we can create a new scan.
I'll do an advanced scan.
We'll just call it advancednetworkscan, a slightly
more advanced network scan.
You would want to put in whatever information
is most helpful to you.
[INAUDIBLE] local is still going to be our target.
Go to discovery, these all look fine for port scanning.
Let's do a TCP network scan. instead of just a SYN
scan, a TCP scan.
So I'll try to connect.
Service discovery's fine, let's go in here
to assessment and web applications
and scan web applications.
We'll enable generic web application tests.
That's fine, maximum runtime, five minutes.
That's reasonable for the next level of scanning.
And we'll go into it, and we'll watch it.
There might be some magic here.
We'll see when it's complete.
Looks like our scan is complete.
Let's go take a look at our vulnerabilities.
We have some highs, a lot of mediums, some mixed.
We'll say you look at this first high.
This is something that we should know about, that there's
some SQL injection possible.
We can go look at the output.
See where it is possible.
Looks like it's in this page name parameter.
So that's something useful that we
would want to write down and include
in our report on vulnerability.
SQL injection is something that should be remedied fairly
easily with some code review.
And in this situation, maybe we're
using a third party software on our site.
And third party risk management is important.
Understanding what vulnerabilities they bring in
is worthwhile.
Or it could be something we built into our own product.
And DevSecOps, or DevOps, needs to take a look at what
is going on in our web app.
We've got our results back.
And we have four to four vulnerabilities,
including some high level ones.
We could take this whole report and export it
as a PDF, or an HTTP, or HTML, or a CSV
if we wanted to combine it with more devices down the line.
CSV might be more useful to get a broad scope, one
single view of the whole network when we run later scans.
HTML is going to be nice and interactive.
And a PDF is something that you could easily hand over
to someone else who needs it.
But that is, generally, how Nessus works.
And I hope we got something out of that,
understanding what a vulnerability scanner can do
and how we can integrate it into our auditing process.
And then, now, as a pen tester, understanding
that they, hopefully, have been running
auditing and vulnerability scans on their network.
And if they haven't, you could integrate that and include it
in the scoping.
This is an essential first step, really.
And depending on the maturity of the organization,
they should be doing this on their own.
Hiring someone, just on IT staff,
who can run the free version Nessus
and scan their own network is not--
is something-- is the recommendation
that you could make that is highly reasonable,
so including that, understanding what you are recommending,
understanding where their maturity is at,
and what is going to be most valuable to the customer,
again, is very, very important as a pen tester.