All language subtitles for 3. Scanning with Nessus - Part 1

Now it's time to play around with Nazis.

So when it comes to nurses nurses is what is called a vulnerability scanner.

You're going to use this quite frequently when you work as a penetration tester slash ethical hacker.

Basically let's say you're doing an external assessment chances are that you're going to use nurses

in that assessment probably even right away.

You might kick off your scans.

Basically you're going to send out an e-mail saying hey scans are about to start and then you're gonna

start your scans and then you get those scans run in while you let those scans run.

They take some time.

They're going to go out and do your information gathering maybe look for those breech credentials.

Try to find something juicy on the client.

Then you'll come back and you'll review your scan results and see if there's anything interesting there.

Same thing with internal Ed the process really doesn't change.

We use nurses quite a bit so we're going to use nurses here and just see what it looks like and how

we can use it to our advantage.

So let's go ahead and just go out to Google and we're going to Google Nexus download

and we're going to go to downloads right here from tenable actually we'll download nexus right here

sorry and up at the top.

We are looking for 64 bit Debian.

So it says Ubuntu but we're just looking for the Debian so we can go ahead and just click on that and

download it.

We'll agree.

We won't even read it and we'll save here and this will take a minute or so to download depending on

your connection speed.

So if you need to pause go ahead and pause.

Now we're going to open up a terminal and I'll make this a little bit bigger and I'm going to see over

to my downloads folder.

That's where it is and then we're going to say DP cagey which is d package and we're going to install

with the dash.

I know Miss to nexus.

There we go.

Just tab if you have nothing in there.

Capital and on the Nexus and you should autocomplete.

And then we'll hit enter and it's going to grab the package and then start to download it here and install

it and you can see automatically it has been installed.

So it says you can certain Asus scanner by typing forward slash Etsy and it d nexus D start going it's

going to copy that and paste it.

And then we're going to navigate to this Cally 4 4 3 8 4 8 8 3 4.

Hey can I talk.

And then you're going to see your connections not secure.

We're just gonna say advance at exception confirm.

And here is NASA's.

Now this is going to compile plug ins here.

So this is going to take some time.

Go ahead and let this finish.

And when it does go ahead and say we're going to download or install nested nests essentials OK.

And then you're going to provide it with your name and you need a valid email for an activation code.

All right.

Once your activation code has arrived the email go ahead and just copy paste and then hit continue and

then it's going to ask you for a username.

So I'm going to say h Adams for me and then others do password 1 2 3.

Because you know I'm super secure.

And I'm not going to save.

And then now it's gonna take a minute.

So just go ahead and pause your video.

Let this install go get a drink.

Go get some coffee.

Whatever it is that makes you happy.

And once your Nexus is installed and you are at a log in screen go ahead and log in and then come back

to the video and we'll start from there who that took for ever.

All right.

So we have loaded SS.

It's installed and now we're brought to this playing screen that says my scans.

Why is it blank.

Well it's blank because we have made a scan yet.

So let's go ahead and go up to new scan and let's quickly talk about what we're capable of doing.

So this is the free edition of Nexus.

This means that we can scan against any private IP address and we can scan up to 16 of those I do believe

at one time.

So remember back to the networking section of your class A through class see that's what we're capable

of scanning here.

If you were to try to go out and scan a Web site or a external host not going to happen.

So we do have a couple options here.

We're gonna start with this basic network scan and then we'll talk a little bit about the advance scan.

So let's go ahead and click on this basic network here and what we can do is we can just type in something

like key optics for the name and I just always copy this because you need a description.

I just like to paste it in the description as well and then down here it's gonna say hey what targets

do you want to scan against.

Well we're only going to provide one IP address and that is the IP of cap tricks and then let's go with

the tabs here on the side.

We've got the scheduled tab schedule sounds exactly what it sounds like.

It's scheduling.

So let's say that you are into automation and you're working as a pen Tester and you it's a Monday morning

at 8:00 maybe you want to sleep in just a little bit longer and you say hey you know I got to e-mail

a client.

I'll schedule that email go out at 8:00.

And then the e-mail is going to say hey we're kicking off scans right now and at 8 or 1 maybe your scan

can kick off and you can schedule that to happen and then you can wake up a little late protests there.

Also you can enable scanning for once daily weekly monthly yearly so if you're in a business you can

do this on a periodic basis and get updated scan results.

There's also notifications the SMP if you have an S empty server most importantly discovery.

So it's going to do port scan of common ports here.

I actually like to do port scan of all ports.

Again this is the same thing as like a dash P versus a dash P dash.

You see the one through sixty five thousand five thirty five.

Here we come down just common ports.

I'm guessing top 1000.

So let's go down into assessment and we see scan type default so we can scan default we can scan for

web vulnerabilities we can scan for all web and all web complex let's just scan for known Web vulnerabilities.

If we go into complex it's going to take a while and this just depends on how deep into the scan you

want to go.

But we'll just going to say for now.

Scan for known Web vulnerabilities and it'll show what it's going to do it's can do some page crawling

do some directory traversing and look for vulnerabilities OK on the report it's going to say hey can

we edit scan results.

Yes we can.

Should we display hosts that respond to paying display unreachable hosts.

I just leave this is default.

Most the time.

And then on the advance tab we have scan type I'd just like to say default here.

So we'll save this and then we'll go ahead and just launch it and you'll see that we'll start spinning.

And now it means we're we're running and this is going to take some time.

So while this is going on let's go ahead and hit new scan up here and let's look at this as well.

So you've got the advance scan and they've got other scans here which I don't use a lot of but you might

have used them in the past if you're familiar with Nexus or they've got a little one off site they've

got this shellshock detection and it looks like they've got these Shadow Broker's detection here.

So they've got a couple of different scans even a malware scan but we're going to go into advance scan.

These are the most common to you'll be using same deal here.

And when we go into discovery you see a discovery is a little bit different.

So we've got a host scanning.

And it says Hey do you want to ping the host.

Or maybe you don't want to bring the host.

And if we do ping the hosts what are we looking for.

Are we looking for our TGP ICMP or UDP.

What do we want to scan.

We want to scan network printers.

If we're doing an internal network assessment maybe we want to click that.

Maybe not.

You know and we can do a different types of scanning here.

There's a lot more options which is what advance scanning is for we could do port scanning you see the

sense scan comes up again a.k.a. still scanning.

We could do UDP even down here it says it's really not possible for a UDP to pick up between open and

filtered ports.

So UDP scanning takes forever and it's not always reliable.

We could do a service discovery.

I kind of just leave these blank or leave them as default and then we come through assessment.

Same thing.

It just gives us additional options here.

So it's always good to click through these do we want to brute force any log ins.

We could use Hydra to do brute forcing if we want.

We could test for default accounts on if we could discover like an Oracle database etc. But this is

going to go through and try empty passwords try log in as password etc..

So this just does a little bit more here.

We can scan web applications and we can say hey we want to use a specific user agent or we want to crawl

from a certain web page.

How many pages we're going to crawl again it just gives us more control.

So if we come down here reporting looks the same and then advance we have a little bit of more options

here as well.

But again either either way if you use advance scan I would start with the basic scan just as a beginner

and then kind of play around data and scan and see if you can scan against the same hosts and maybe

get back more information and maybe key objects is a good one to play with.

But let's go ahead and go over to credentials and now if you have credentials for a machine and you

wanted to like log into that machine the SSA at your windows or even S&P you can enter in credentials

and you could scan a little bit deeper on the machine but you're likely never going to get that as a

pen Tester because you usually don't have any access.

So let's go back to our scans and you see now that it's scanning and running.

The nice thing is that it does update vulnerabilities as it finds them and it is finding them we're

actually at ninety nine percent right now.

So you can click in it and you can see that it's got all different kind of vulnerabilities.

And right now they're kind of grouped.

So we don't worry about them too much we're going to group this once it's done.

So I tell you what.

Go ahead let your scan finish once your scans finish.

I'm going to meet you over in the next video which is going to be part two or we're going to look at

the scan results.

Talk about him a little bit and see what nurses can do for us.