-: Interpreting scan results.
In this lesson we're gonna talk about how you can
go through the scan results you get
from your Vulnerability Scanner
to understand each and every detail of that report.
Now, why is it important to understand your scan results?
Well, the scanners do a great job of automating
the scanning itself and identifying the vulnerabilities.
But it does take a trained analyst, like you,
to be able to understand what those vulnerabilities are
and the impact to your network.
You need to understand if there are
things like false positives and the way to eliminate them.
You need to understand how to find the root cause
behind the vulnerability.
And you need to understand
how to prioritize the remediation actions.
All of these are done by a human
who takes the results of the scan,
looks at the details of those reports,
and then can make those intelligent decisions.
So, when you take a scan report,
you can get something that looks like this.
This is your scan result.
This is the first page of a report
that's about 30 or 40 pages for this particular network scan
that I performed.
This one is Nessus, but there are others out there
just like you can use Qualys Guard
and they'll look very similar.
We're gonna go through the Nessus scan
because really what's important is
that you understand how to read these reports.
And we're gonna cover these
section by section in this lesson.
The first page you're gonna see is something like this
that's gonna give you your table of contents essentially.
It's all the vulnerabilities that are identified by plugin.
Now, for the rest of this lesson I'm gonna
dig into the first vulnerability found here.
Which is the MS17-010
or more commonly known as The Eternal Blue.
So, if you click on that, you'll get a screen
that looks like this, which is a detailed scan result.
Now, I zoomed way out on here.
We're gonna zoom into each section of this
as we move forward.
But I just wanna give you an idea of what it looks like
before we dig into each of those sections.
Across the top, in the red bar,
is the name of the particular vulnerability.
In this case, it was the Nessus plugin 97833
and it addressed the security update for Microsoft,
which was the MS17-010
or Eternal Blue
the SMB server vulnerability.
Now let's zoom in so we can get a better look.
So we look at the synopsis and the description.
That's the first two blocks we're gonna come to.
The synopsis is just a one or two sentence
that's gonna explain what this vulnerability is all about.
In the case of Eternal Blue, it was a remote Windows host
that can be affected by multiple vulnerabilities
and there was numerous vulnerabilities
it associated with it.
Now, if you go into the description,
it's gonna describe it a little bit further
It's gonna tell you about the fact that Eternal Blue
takes place inside the exploitation
of the Server Message Block version one protocol
and that this affects a lot different CVEs
that were released or vulnerability exploits out there.
And you can see those on the screen CVE-2017-0143,
0144,
145,
146,
148, and some others.
It's gonna give you information about it.
It's gonna tell you the different names of it
and how it's been exploited.
That's gonna give you a detailed description.
Again, for this lesson, it's not important
that you understand this particular vulnerability.
I'm just trying to show you
what these different sections are
because each report and each vulnerability
is gonna be different based on the plugin
and the exploit that's been identified.
The next section you're gonna get to is See Also.
And that's gonna give you references.
So, if your boss says:
hey, I need more information on
Microsoft 17-010 or Eternal Blue.
You can go into this See Also
and start going through these links.
You'll find out how to stop using SMB version one.
To rectify the problem you can go
to the Microsoft security bulletin
which will tell you all about the problem
and the technique behind it and what patches are associated.
Any information about this vulnerability
that is known in the common database is gonna be shown here
as references known as See Also.
The next thing you're gonna come to is the solution.
And this is important
because you wanna know how to stop this problem
from happening on your network, right?
You've scanned your network and you've found
that it is vulnerable to Eternal Blue, in this case.
And so now you wanna say: how can we fix it?
Well, if you look here in the solution, it's gonna tell you.
It's gonna tell you that Microsoft has released
a set of patches for Windows Vista 2008, Windows 7,
Windows 2008 R2,
2012,
8.1,
Windows 10, Windows 2016,
all of them.
And in fact this was such a bad exploit
that they even went back to old unsupported software,
like Windows XP and 2003, and they released
updates to those, as well, to patch this vulnerability.
It was that bad.
And then it'll tell you
that if you have an unsupported software,
you should upgrade it.
You should stop using SMBv1.
You can read all the solutions here
but each one's gonna be different
for that particular vulnerability.
In this case, the big thing was SMBv1 was vulnerable,
somebody found an attack,
to solve it you need to turn off SMBv1
or preferably you wanna patch the system
and start blocking it at the Firewall, as well.
The next section you're gonna come to
is your risk factor and your CVSS score.
Your risk factor is, is it low, medium, high, or critical?
And that comes based on the CVSS score,
which is the Common Vulnerability Scoring System.
We're gonna cover that in depth in a future lesson,
how it's calculated and everything else.
But for here I just want you to realize
that this is the section where you're gonna find that.
You can see on the screen here there's actually two types
of vulnerability scoring systems.
There's version 3.0 and there's the one
that doesn't have a version which is version two
which you can see there on the fourth and fifth line
of this slide.
Now, if you're studying for the CSA Plus exam
you need to understand CVSS the normal way, the 2.0 way,
not the 3.0 way.
3.0 came out after the exam was written
and, so, the exam does not address CVSS 3.0.
In the real world you can use the regular way, 2.0,
or the newer 3.0 system.
They're calculated just a little bit differently
and 3.0 has a little bit more information.
Again, we'll cover that specifically in a separate lecture
because it is a much more in-depth topic
and we will cover that.
And then you have the STIG severity which, again,
is more of a military thing or a government thing.
When you start dealing with
the Defense Information Systems Agency or FISMA stuff,
STIG severity one, two, and three is their category.
Category one, which this is, is the most severe or critical.
Category two is medium.
Category three is lower, informational.
The next thing you're gonna find is References.
Now, why is References different than See Also?
Well, See Also gave you all the website links
of information about it.
References, in this case, is gonna talk about
what does this particular plugin reference.
And, in this case, you can see on the first line,
it references an IAVA which, again, is a government thing.
Then it has a Microsoft knowledge base number
as the second line.
And then it goes into the open source vulnerability database
with the CVEs and cross references
in the XREF scripting language.
So, that's where references are and, again,
you can click on any of these.
They'll open in a new window and give you
all the information you want
about those particular vulnerabilities
and how this plugin is detecting those.
The next thing you're gonna find is exploitability,
plugin and hosts.
And this is actually the last section
inside this vulnerability.
Exploitable with is what do they know that's out there
that can exploit this vulnerability.
In the case of Eternal Blue, there's Core Impact,
it can do it, and Metasploit has a vulnerability for it
and it can do it.
Any time I see Metasploit, I get really worried
because Metasploit is pretty darn easy to use.
Anyone on the internet can download Metasploit,
download the exploit,
and then they can start attacking your networks.
So, if you have something that is exploited by Metasploit
that's gonna raise that CVSS score
and raise it into a higher category, as well.
The next thing is the plugin information.
When was the plugin actually created from Nessus.
In this one, it was created the 20th of March
and it was modified again in June 28th both of 2017.
This exploit was discovered in the March time frame.
They got a discoverability out very quickly.
They got patches out very quickly.
Then they modified it as this was changing
and more CVEs were added to it
to find different variants of the Eternal Blue.
And then hosts, which hosts on your network
are vulnerable to it?
In the case of this scan, there's only two.
There is the 192.168.15.112
and 113.
That tells you exactly to go find those two servers,
take them offline, get them patched,
and then bring them back on the network.
So, that's gonna give you a good overview
of what we have inside the scan report.
I know I went through that really quickly.
The best way to learn this is pull a report,
and if you go to Nessus
and google Nessus vulnerability report sample,
you can download a bunch of different sample reports
and start looking through them
and clicking around in them
and getting to understand how these are laid out
and what they look like.