All language subtitles for 4. Discovering Vulnerabilities With Nessus

OK, that was loading for over an hour, but it is finally over.

So we are ready to explore the necesito it is pretty simple to use your page should be blank since you

haven't performed any scan yet.

So we can click right here on this X button just to see better this page.

And all you want to do from here is go to the new scan button.

Right here, we will see all of the available options that we can do for our scans, so we got basic

network scan, as it says, a full system scan suitable for any host.

We got the advance scan, configure a scan without using any recommendations, and we got a bunch of

the other options.

And for some of them, we need the less professional version in order to use, such as this one, this

one, this one, and all of these that have the upgrade on them.

Now, it's already talked about witness centrals.

We're only going to be able to scan local IP addresses inside of a company.

You could use this tool to scan their networks for vulnerabilities.

However, you cannot scan an external IP address with this scanning a website is not going to work unless

it's inside of your network.

Another thing to remind you is that we can scan with the free version up to 16 IP addresses, and if

I'm not mistaken, those 16 IP addresses clean after 90 days.

So after 90 days, you will be able to scan more IP addresses, but I'm not sure about that.

And if you have a free version and you have more than 16 targets, you will have to scan that network

with multiple Nessa's scans.

So scanning big enterprise networks for big companies will require NASA's professional version.

But what we want to do here to learn Nessus and how to use it, we want to go on to the basic networks

can.

And this basic scan will require us to specify some options now for our first scan will be scanning

only.

So turn it on.

If you haven't already, check out the iPad to submit depletable.

In my case, it is 190 to date, 168 at one point for.

And once you do that, we can proceed to specify our options in the general tab under the name, you

could specify anything you want.

I will simply just type method exploitable under the description.

I will just leave this empty.

There is nothing really to specify here.

You can put anything you want here.

Just you can recognize which type of scan you did and on which target you did it in the folder.

We will leave it on my scans and in the targets we specify the IP address of our target machine, since

right now we are only scanning one machine.

We will specify the IP address of metal plate.

But if you were to scan on network, you would specify something like this.

Wanted to do that 168 at one point one twenty four in case it is a 24 network.

I believe you can also specified like this.

So want to add to the 168 that one dot two fifty five.

But right now let us just go with our metal plate and with the free version we can even scan two hundred

and fifty five hosts.

Remember we can only scan 16.

Once you specify this, we want to proceed to the schedule tab and here this schedule tab is useful

once you want to schedule their scans on a certain period of time or you just want to schedule a scan

while you're doing something else on the site.

For now, we're going to leave it off under the notifications.

You can choose if you want to send results to some emails over SMTP server.

We are not going to be doing that right now in the Discovery tab.

This is the important stuff.

Here we choose how many and which ports we want to scan, we have an option of scanning common ports

and this is similar to a map default ports.

It will only scan most popular ports or you can select scan all ports, which we are going to use right

now to scan all sixty five thousand ports, no exploitable.

And if you want, there is a custom option, which is the third option right here.

But we are pretty satisfied with this scan all ports option.

If you read the settings, the general settings always tells the Nexus localhost use Fastnet for discovery

and of the ports or settings.

We have scanned all ports usenet's that if credentials are provided use since scanner if necessary,

and we're pinging hosts using TCP, AAFP and ICMP.

Good.

Once you set this to scan all ports, you can go to the assessment and in the assessment tab we can

choose what we want to scan for.

So there are a few options.

If I click right here on this can type, we have scanned for known web vulnerabilities, scan for all

web and abilities and scan for all Verbruggen abilities complex.

For the purposes of this tutorial, we will be scanning for known Web vulnerabilities.

Why?

Well, this will just take lesser time to finish.

When you run scan for complex web vulnerabilities, it usually takes a lot more time and we can see

right here and the general settings avoid potential false alarms enabled by scanning and web applications.

We will crawl up to one thousand pages, up to six directories, and we will test for known vulnerabilities

in commonly used Web applications.

These are our assessment settings.

But also, keep in mind that if we discover some vulnerabilities, we will see how to attack them in

the Web penetration testing section that will come right after the exploitation section.

For now, let us just see whether Nessus will find something juicy right after we go to the report settings.

And usually you want to leave this on default.

So we are not going to be changing anything right here.

And finally, in the advanced that we will leave it on default for now and proceed to click on Save.

So click on Save right here.

And you should have your skin right here.

Now you will notice that it does not automatically start, we must launch it and we do that by clicking

on this arrow right here, which says launch, click on it.

In just a few seconds, here it is, these green arrows will start spinning and our skin has officially

started.

This will try to discover all the vulnerabilities it can find for the political machine.

Now, keep in mind that these scans can take a lot longer then and map scans.

You can always check the current status scan by clicking on the scan name, in our case on the anticipatable.

And you will be able to see what it managed to find for now during the scan, different vulnerabilities

will be marked with different colors.

We will have blue color, which means information, disclosure.

And what that is, is it possibly managed to find some information that should be private or it managed

to find the service version or something similar that allows us to find out more information about the

target?

It doesn't necessarily mean that the information is useful, though.

Then we have green, yellow and orange vulnerabilities or also known as low, medium and high vulnerabilities.

And at the end we get the most interesting vulnerabilities which are critical vulnerabilities.

This usually includes remote code execution or something similar.

So what you can also do, you can click on them, and this is just what it managed to find at this current

point of scan.

So we got one critical vulnerability for now.

We got to mix vulnerabilities, one medium vulnerability and some information disclosure right here.

Let's go back and we're going to wait for this to finish, and once it's done, we will get back to

it and see the results.

All right.

It is finally over.

And we can see if I click on the scan that it managed to discover a bunch of vulnerabilities, all kinds

of them.

Let us go through these results and see some of the vulnerabilities it found.

Remember, we are most interested in critical and high vulnerabilities.

Others can also be useful, but these two are the main ones.

First thing we see is that it managed to find seven critical motability, 11 vulnerabilities.

Thirty six medium vulnerabilities, seven low and one hundred and forty eight information disclosure.

Let us click on the scan.

Right here, we can order the vulnerabilities by their severity, so if I click on this arrow, it will

go from the information to the critical, but mostly we are interested in critical vulnerabilities.

So click it once again and let's go with any one of them.

We're going to see an example of each vulnerability.

We're going to check one critical, one high, one medium, one low and one information disclosure.

Let's go, for example, with this one.

So it says Neff's exported share information, disclosure, this is a critical vulnerability down here,

we can see the description and it says at least one of the NAFS shares exported by the remote server

could be mounted by the scanning host and attacker may be able to leverage this to read and possibly

Vereide files on remote host.

He tells us what is the solution to fix this vulnerability, as it says Conficker nafs on the remote

coast so that only authorized hosts can mount its remote shares.

Down here.

It tells us where it found the vulnerability.

It found it on our display table on the two thousand forty nine UDP port.

And what you would do, for example, is you would then Google this vulnerability, which we learned

in the previous video, were recovered Googling vulnerabilities and search it and you would see how

you would exploit this.

For now, we know that this exists.

Let's check another critical vulnerability.

Let's go, for example, onto this one, bandshell, factor detection.

It says a shell is listing on the remote port without any notification being required, an attacker

may use it by connecting to the remote port and sending commands directly.

Hmm.

This seems like a really big problem.

And we're going to see in the next section how we can actually gain access from this critical vulnerability.

It is very, very easy, trust me.

But these types of misconfiguration happen often down here.

We can see the solution, verify the remote coast has been compromised and reinstall the system if necessary.

And the actual motability is found on the port one five to four over Tsipi.

Now, since critical vulnerabilities are most important.

Let us check another one.

Let's go on to this one free and see server password is password.

So it seems that we get the default credentials for some software running on our anticipatable.

As it says, the server running on the remote coast is secured with a weak password.

And this type of vulnerability is something that you will find the most.

Now, it doesn't have to be anything connected to the BNC server, but weak credentials are something

that even the biggest companies have.

And you can have all the security in the world.

But if your password is weak, none of that security will matter.

Down here, we see the Nessus logged in using a password password.

And what was it on?

It was port five thousand and nine hundred over TSIPI So we will see how we can exploit all of this.

But let us also check out some other vulnerabilities as well.

Pache, Tomcat, HP, Connecter, request injection.

Let's click on it.

This seems to be a high vulnerability and it tells us a fault for inclusion.

Motability was found in HP Connecter.

Our remote unauthenticated attacker could exploit this vulnerability to read Web application files from

a vulnerable server.

It tells us that the solution is to actually upgrade Tomcat server to the newer version.

And down here it tells us over which port did it find a vulnerability, which is Port 29.

On the right side, we can also see some additional vulnerability information, such as what is the

vulnerability for?

It is for Apache attack.

It is the exploit available.

Yes, the exploit exists for this and they are available.

The patch was published on March 1st, 2020, and vulnerability was also published on that same day.

And Nessus managed to successfully exploit it, reference information and here the vulnerability names.

She would just type this search for an exploit for it and you would manage to exploit them at this point,

the machine.

Let's check out a few more vulnerabilities and then we are going to wrap up with this tutorial.

Let's go to a medium one and let's go, for example, to this one.

SMB signing not required.

Signing is not required under both SMB server and authenticated remote.

Tacker can exploit this to conduct man in the middle attacks against the SMB server.

Now we have not covered many in the middle yet, but later in the course we will be devoting an entire

section to this attack to the man in the middle attack.

So for now, we just know that the S&P support, which is running on Port four for five, is vulnerable

to the man in the middle attacks.

OK, let us also check out some information disclosure.

So right here we can open a cell detection service detection, get request SSL DL's version supported

so we can check out which SSL and versions are supported.

This plug into text, which are some Thaler's versions, are supported by the Remote Service for Encrypting

Communications, and this port seems to be running SSL version two as Salvacion three and version one.

And these are just different protocols used for encryption of the data that is being transferred over

this port.

And once again, you will see that SSL is vulnerable to the man in the middle attack.

We can decrypt this data using that specific attack.

However, don't worry, if you fully don't understand what I'm talking about, this is once again something

that we will cover in a later section.

OK, great.

Do you see right now how amazing this NSA scandal is?

It literally gave us most of the vulnerabilities just from a single scan in the next section.

We will see how to exploit most of these vulnerabilities on them at this point, but on other targets

as well.

In the next video, we're going to scan other machine using Nessus and we're going to see what results

we get see in the next.