-: In this demonstration, you're going to see
how Nessus is used to conduct a vulnerability scan
on a small office network.
Now, Nessus is a vulnerability scanning tool
that comes with a complete suite of features.
Beyond scanning, it also can keep track
of your past vulnerabilities and reports,
and it gives you a lot of great management functionality.
For the Security+ exam, you don't need to learn
how to operate this tool.
But if you end up getting a job as a security analyst,
you're going to be using Nessus
or another tool like Qualysguard, OpenVAS,
or another vulnerability scanner
to perform a lot of your daily job functions.
So, let's jump into the lab environment
and learn just a little bit more about Nessus.
Now, there's a couple of tabs here.
We have the Reports tabs,
which will show us any complete reports
that we have already done before.
Now if we have multiple reports,
we can actually compare those reports.
So this is very helpful in vulnerability management.
I might have a scan for last week,
and then I have from this week.
And so I can open up the one from before,
compare it to the one I just did,
and then see what the difference is
where this one I might have had
one vulnerability here and one vulnerability there.
I can see if those vulnerabilities have been fixed
by the system administration team.
So that's one of the ways you can use this tool,
is by going back and looking at that historical data.
You can also download these reports
if you need to give them to the system administrators,
either by email or through your file share.
Now, when you go to your scans,
this is where your scans will be run.
Now we don't have any scans set yet,
because we haven't set any policies.
So the first thing I want to do
is go over to my Policies tab.
In here, we already have a couple of
scans that are set up.
We have web app test.
We have preparing for our PCI-DSS audits.
We have internal networks scans or external network scans.
These are all templates that are provided by Tenable.
Now, instead of using those,
I'm going to show you how you can create your own
by clicking on add and giving it a name.
We're going to call this Windows Scan.
And I'm going to use Scan to Windows machines
that are in this network.
And you can actually set the port scanners
with doing TCP scans or SN/MP scans,
whatever you want.
I'm going to leave the default settings here right now
just so that we can get going with this.
Now we're going to click on credentials.
This is where you would put in your SMB account,
which would be your username and password
if you're going to do a credentialed scan.
We talked about this before
where sometimes the scanners are going to be blocked
by defenses in route,
such as you're trying to do it
from an attacker's perspective,
you would not use a credential scan.
But as a vulnerability manager,
you would want to use a credentialed scan, possibly,
so you can get more information
on what vulnerabilities exist so you can solve those.
Now, the important here is going to be your plug=ins.
And you can see these are green
because they're enabled right now.
Let's scroll down here to the Windows plugin,
and you can see that all of these different plugins,
each of these is a different vulnerability
that it's trying to exploit,
or find out if that exist inside of that server.
So, we can turn on a plugin or turn of a plugin
just by clicking the Disable,
and you can see the Windows family has gone away.
Because I'm going to do the Windows family,
I'm just going to take everything else out right now,
and disable them.
So I can click on what I want, and then click on Disable.
So you get the idea.
We could turn things on
or turn things off as needed.
For instance, since I know I'm going to be scanning Windows,
do I need to look at the CentOS?
Probably not, right?
Because I don't have a CentOS device.
You get the idea.
So you can actually hit Disable All
and everything will be disabled,
and then you can turn on just what you want.
In my case, I'm just going to scan
for these three Windows plugins
to make our scan go much quicker.
And these three families actually have
3,000 different vulnerabilities
that we're going to be scanning for.
The last thing is Preferences.
If you have domain controller passwords and usernames,
you can check those as well.
So, I'm going to go ahead and submit that.
And now you can see that I have this Window Scan
which is a private policy that I have created
and it's set by the user which is me.
Now we're going to go ahead and go to Scan
and we're going to add a new scan.
Here's where we can do your scans.
You'll give it a name so you'll know what it is,
and you can schedule it.
You can use a templated one or run it now.
I'm going to run it now,
but if you want to do it, you could schedule it,
and you can schedule it based on
every day, every week, every month, every year,
or just once.
In our case, we're going to run it now.
We're going to select the policy we want,
and we're going to use the policy that we just created,
which was Windows Scan,
and I'm going to give it the targets.
Now you can give it the entire range of an IP address.
For instance, if I had the 10.3.1.0/24 range,
that's going to scan all 256 clients inside that subnet.
In my case, there's two that I want to scan,
the 10.3.1.6
and the 10.3.2.3.
The first one is a Windows 2003 Server,
the second one is a Windows 2012 Server.
And you can also lanch a Browse for a text file
or a comma-separated value file
with all of your IPs,
and use those as your target files
so you don't have to type them in individually each time.
I'm going to go ahead and launch the scan,
and it's going to go ahead
and take a couple of minutes here to run the scan
because it does take a while.
It is to reach out to each machine
and run those 3,300 or so vulnerabilities against it
to identify which ones they have
and which ones are active.
So, I'm going to go ahead and pause the video here
and come back when the scan is complete.
Alright.
That scan only took about a minute actually.
And so, once it finishes, it clears it from our scans
because there's no more scheduled scans,
but it does show up now in our reports.
And you can see there TestScan has just completed at 16:57.
And again, we can go ahead and double click it
if we want to browse it,
and we'll see which scans have which vulnerabilities.
Here you can see the vulnerability count.
For instance, here there's 12,
and you can see the criticality.
By default, it's going to show you based on criticality
most critical to least critical,
and they go from critical to high, to medium,
to low, or informational.
And you'll see the number of counts
or the number of vulnerabilities that exist.
This can be a helpful view,
but the one I actually prefer is the host view
from a vulnerability management perspective.
So when I go ahead and click on Host View,
you can see right away which of these servers
is the most vulnerable.
Which one do you think it is?
That's right, it's the 10.3.1.6
which I told you was a Windows 2003 Server,
and a 2003 Server is very vulnerable.
There are seven critical vulnerabilities,
one high, one medium, and then 17 informational.
If I look at the 2008 server on the other hand,
we have zero criticals, zero high,
zero medium, and zero low, and only 18 informational.
It's a much more secure server.
And so, we can actually look at it and go,
if I had to apply resources to one of these servers
and I only had a certain amount of time and money,
which one would I fix first?
I would fix the 2003 Server
because it has more vulnerabilities that can be exploited
by a known adversary.
Now if you want to dig into each of those vulnerabilities,
which you'll need to,
to be able to figure out what's wrong with it,
you can then click on it and dig in a little bit deeper.
So, let's say I wanted to fix this one.
This is a very common vulnerability, the MS08-067.
I can click on that.
It will show up the information
of what the vulnerability is.
It tells me it's arbitrary code execution.
It gives me a description of it,
which is actually remote code execution
against Windows 2000, XP, 2003, Vista, and 2008
if you don't have a patch installed.
It's a critical risk factor,
which means I want to fix it right away as soon as I can,
and the CVS...
Excuse me.
The CVSS Base Score is a 10,
which tells you it is very, very critical.
And you can see here that it doesn't apply to any virus,
but it does affect your,
it could affect your confidentiality and integrity
and things of that nature.
Now as you scroll down a little bit further,
you actually get a link to what the IAVA is,
which tells you what the military or government version
of how to fix this is,
the Microsoft vulnerability which is MS08-067,
and the CWE which is number 94.
And you can cross reference these
in the vulnerability database.
Pull that up if you're connected to the internet,
and it will tell you exactly
what is wrong and how to fix it.
In our case, because it's this one,
that is going to tell us that we can go to Microsoft
and download something to fix it.
Now, how is it exploited?
Well, lots of things have an exploit for it.
Canvas has an exploit for it.
Core Impact has an exploit for it.
Metasploit has an exploit for it.
And if any of these things have this exploit,
it's a public vulnerability
which means we should really, really be worried about it,
because any script kiddie can basically attack us
using this vulnerability.
So, you can see how you can really dig in deep here
with the vulnerability scans,
either based on individual scan, by looking at the host,
or digging into the particular vulnerability
and knowing which plugin was used
and what patch needs to be applied.
If you take this information
and give it to your system administrators,
they can implement a change control process,
implement the bug fix,
and get you into a less vulnerable state
where you'll go through and scan again
to see how that looks as you compare the two scans.
(electronic music)