ComputerSecurityStudent (CSS) [Login] [Join Now]




|SECURITY TOOLS >> NESSUS >> Current Page |Views: 1875

(NESSUS: Lesson 5)

{ Scan with Nessus using Kali }


Section 0. Background Information
  1. What is the purpose of this lesson?
    • In the previous lessons you use NMAP to determine which services were running, using a methodology known as port scanning.  This lesson will teach you how use Nessus to conduct a vulnerability assessment.

  2. What is NESSUS?
    • Tenable Network Security provides enterprise-class solutions for continuous monitoring and visibility of vulnerabilities, configurations, user activity and system events that impact security and compliance.

    • Nessus features high-speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of your security posture

  3. Pre-Requisite
  4. Lab Notes
    • In this lab we will do the following:
      1. Scan Damn Vulnerable WXP-SP2 with nmap
      2. Scan Damn Vulnerable WXP-SP2 with Nessus
      3. Product Nessus Report
      4. Save Nessus Report

  5. Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2024 No content replication of any kind is allowed without express written permission.

 

Section 1: Login to Kali
  1. Start Up VMWare Player
    • Instructions:
      1. Click the Start Button
      2. Type Vmplayer in the search box
      3. Click on Vmplayer
     
  2. Start Up VMWare Player
    • Instructions:
      1. Click the Start Button
      2. Type Vmplayer in the search box
      3. Click on Vmplayer

     

  3. Edit Virtual Machine Settings
    • Instructions:
      1. Click on Network Adapter
      2. Click on the Bridged Radio button
      3. Click on the OK Button

     

  4. Play the kali2 VM
    • Instructions:
      1. Click on the kali2 VM
      2. Click on Play virtual machine

     

  5. Supply Username and Password
    • Instructions:
      1. Provide username 
      2. Provide password
      3. Click the Log In Button

 

Section 2: Login to Damn Vulnerable WXP-SP2 (Victim Machine)
  1. Edit Virtual Machine Settings
    • Instructions:
      1. Click on Damn Vulnerable WXP-SP2
      2. Edit Virtual Machine Settings
    • Note:
      • This VM is running Windows XP.
      • This is the Victim Machine that we will be scanning with Nessus.

     

  2. Set Network Adapter
    • Instructions:
      1. Click on Network Adapter
      2. Click on the radio button "Bridged: Connected directly to the physical network".
      3. Click the OK button

     

  3. Start Up Damn Vulnerable WXP-SP2
    • Instructions:
      1. Start Up your VMware Player
      2. Play virtual machine

     

  4. Logging into Damn Vulnerable WXP-SP2
    • Instructions:
      1. Click Administrator
      2. Supply Your Password
      3. Click On

     

  5. Open a Command Prompt
    • Instructions:
      1. Start --> All Programs --> Accessories --> Command Prompt

     

  6. Obtain the IP Address
    • Instructions:
      1. ipconfig
      2. Record Your IP Address
    • Note(FYI):
      • #1, (ipconfig) displays all current TCP/IP network configuration values.
      • #2, In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.1.96.

 

Section 3: Bring up a console terminal
  1. Open a Terminal Emulator
    • Instructions:
      1. Click the Kali Icon in the upper left corner
      2. Search for the string root terminal
      3. Click on the Root Terminal Emulator Icon

     

  2. Authentication
    • Instructions:
      1. Supply Password
      2. Click the Authenticate Button

     

  3. Obtain the IP Address
    • Instructions:
      1. ifconfig -a
      2. Record your IP Address
    • Note(FYI):
      • My IP address 192.168.1.94.
      • In your case, it will probably be different.
      • Run "dhclient -v" if you do not have an IP address.

     

Section 4: Basic nmap testing
  1. NMAP OS Detection and Service Discovery
    • Instructions:
      1. nmap -O -sV 192.168.1.96
      2. Observe the detected ports and their services
      3. Observe the detected Operating System
    • Note(FYI):
      • Arrow #1: (nmap) is a network mapping tool, that is using the (-O) flag to detect the operating system and (-sV) to detect the service associated with the particular port on the vulnerable device (e.g., 192.168.1.96). 
      • Replace (192.168.1.96) with the IP of your Damn Vulnerable WXP machine found in (Section 2, Step 6).

     

  2. Using smb-vuln-ms08-067.nse
    • Instructions:
      1. nmap --script smb-vuln-ms08-067.nse -p445 192.168.1.96
      2. nmap believes this machine is vulnerable
    • Note(FYI):
      • Arrow #1: (nmap) is using a NSE script (e.g., smb-vuln-ms08-067.nse)over port (-p445) to determine if the device (e.g., 192.168.1.96) is vulnerable to MS08-067.
      • Replace (192.168.1.96) with the IP of your Damn Vulnerable WXP machine found in (Section 2, Step 6). 
      • The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks.

 

Section 5: Start the Nessus Service
  1. Start Nessus Service
    • Instructions:
      1. systemctl start nessusd
      2. ps -eaf | grep nessus | grep -v grep
      3. netstat -naop | grep nessus
    • Note(FYI):
      • Arrow #1: Use (systemctl) to control the systemd system and service manager.  In this case, we are using (systemctl) to start the nessus daemon (e.g., nessusd).
      • Arrow #2: Use (ps -eaf)to show me all the processes.  Use (| grep  nessus) to search for all nessus processes.  Use (| grep -v grep) to no display the actual grep process.

 

Section 6: Configure Firefox Downloads
  1. Start Firefox Instance
    • Instructions:
      1. Click the Kali Icon
      2. Search for firefox
      3. Click the FireFox ESR Icon

     

  2. Enable Menu Bar
    • Instructions:
      1. Left Click by the Home Icon
      2. Select the Menu Bar

     

  3. Enter Setting
    • Instructions:
      1. Select Edit
      2. Select Settings

     

  4. Configure Downloads
    • Instructions:
      1. Search for downloads
      2. Select Always ask you where to save files

 

Section 7: Login To Nessus
  1. Invalid Certificate Warning
    • Instructions:
      1. Navigate to https://127.0.0.1:8834/
      2. Click the Advanced button
      3. Click the Accept the Risk and Continue button

     

  2. Login To Nessus
    • Instructions:
      1. Login: student
      2. Password: Supply Password
      3. Click the Sign In Button
    •  

     

Section 8: Scan with Nessus
  1. Create Folder
    • Instructions:
      1. Click the New Folder button
      2. Name: hackingdo
      3. Click the Create button

     

  2. Create New Scan
    • Instructions:
      1. Click on the hackingdo folder
      2. Click the New Scan button

     

  3. Select Scan Template
    • Instructions:
      1. Click on Advanced Scan

     

  4. New Basic Network Scan Policy
    • Instructions:
      1. Name: Damn Vulnerable WXP
      2. Folder: hackingdo
      3. Targets: 192.168.1.96
    • Note(FYI):
      1. The IP for my Damn Vulnerable WXP machine is 192.168.1.96.  Your IP address will most likely be different and can be retrieved from (Section 2, Step 6).

     

  5. Assessment
    • Instructions:
      1. Click Assessment
      2. Select Windows
      3. Check Request information about the SMB Domain
      4. Click the Save Button

     

  6. Run Scan
    • Instructions:
      1. Click on the hackingdo folder
      2. Click on the Arrow Assessment

     

  7. Scan in Progress
    • Instructions:
      1. The Arrow changing to a Pinwheel signifies that the scan is running
    • Note(FYI):
      1. The scan will take between 5 to 10 minutes to run.

     

  8. Scan Completed
    • Instructions:
      1. The Arrow will change from a Pinwheel to a Checkmark once complete.
      2. Click on the "Damn Vulnerable WX" Scan name.

     

  9. View Vulnerabilities
    • Instructions:
      1. Notice the Severity summary of vulnerability counts
      2. Click on number in the Vulnerability tab

     

  10. Expand Vulnerability List
    • Instructions:
      1. Click on the Gear Icon
      2. Select Disable Groups

     

  11. Select MS08-067
    • Instructions:
      1. Click on MS08-067

     

  12. View MS08-067 Vulnerability
    • Instructions:
      1. Observe the Title
      2. Read the Description
      3. Scroll Down

     

  13. Exploit Information
    • Instructions:
      1. Exploits are confirmed to exist
      2. A Metasploit module exists for this vulnerability
    • Note(FYI):
      1. Naturally, the next step as a penetration tester would be to attempt the Metasploit exploit module for this vulnerabilty.

     

  14. Access Report
    • Instructions:
      1. Click on the hackingdo folder
      2. Click on the Damn Vulnerable WX scan

     

  15. Export and Create Report
    • Instructions:
      1. Click on the Report button
      2. Click on CSV radio button
      3. Click on Select All
      4. Click on the Generate Report button

     

  16. Name and Save Report
    • Instructions:
      1. Name: DVWXP_1.csv
      2. Click on the Save button

     

  17. Export and Create Report
    • Instructions:
      1. Click on the Report button
      2. Click on CSV radio button
      3. Click on Select All
      4. Click on the Generate Report button

     

Section 9: Proof of Lab
  1. Proof of Lab
    • Instructions
      1. Click on the in use Terminal Icon
      2. cd /home/student/Downloads
      3. ls -l *.csv
      4. grep -i "ms08-067" DVWXP_1.csv
      5. date
      6. echo "Your Name"
        • Put in your actual name in place of "Your Name"
        • e.g., echo "John Gray"
    • Proof Of Lab Instructions:
      1. Press the PrtScn key
      2. Paste into a word document
      3. Upload to Moodle


Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth