‫At last, we are ready to start a NASA's vulnerability scan.
‫This is the main page of the Nessus Web interface.
‫We are in my scan section of scans tab.
‫At the upper left corner click new newschannel.
‫First, Nessa's asks for the scanner.
‫We have seen them before, so here we can choose the most suitable one for our skin, but in the home
‫version of Nessus, unfortunately, some scans are disabled.
‫If you click internal PCI network scan, for example, the application redirects you to the Nessa's
‫website, to Nessa's professional.
‫There are also available scanners like basic network scan or alternatively go to user defined tab and
‫select your own policy.
‫This is the policy we defined in the previous lecture, so I chose this.
‫Now give a name to your scan.
‫As you can see on the right side of the name Feel, the required fields are identified by Nessa's.
‫So write a description if you want.
‫Select a folder for the outputs and define the targets, you can list the host in target field one by
‫one.
‫I want to scan my two systems now nine nine one three nine is a WASP bwa.
‫And nine nine two zero six as my immediate employable system.
‫So if you want a multiple IP addresses.
‫Just put a comma in between them.
‫You can also define an IP block or a range.
‫Just as you remember the unmap lectures or alternatively, if you have a file that contains a list of
‫the hosts that we also covered earlier, you can have that file using the add file link in the upload
‫targets field.
‫So now we're ready to launch the scan at the bottom of the page, select save or click the down arrow
‫button and select launch to start the scan immediately.
‫I choose, launch it first, save the scanned and then launched immediately.
‫So while scanning, let's see some of the parts of Nessa's interface.
‫At the left, you see the folders next to my scans folder.
‫It says that I have one active scan and then my scans page.
‫You see the scan that we just started.
‫If you click on it, you see the scan details.
‫There are three tabs here hosts vulnerabilities and history.
‫When you click on the Vulnerabilities tab, you see the vulnerabilities found during the scan here,
‫we already have some results.
‫Now click the hosts tab to turn back.
‫These are the systems that we defined as targets or WASP, BWA and Métis voidable at the right, you
‫see the severity levels of the vulnerabilities.
‫Nessa's classifies vulnerabilities into five levels.
‫Informational level quickly identifies non-voter ability information, which is, well, nice to know
‫and separates them from the vulnerability detail, which is need to know.
‫Right?
‫Low level identifies the flaws that might help an attacker to better refine his attack, but by itself,
‫that flaw won't be sufficient for a compromise.
‫Medium level identifies it.
‫Some information is leaking from the remote host.
‫An attacker might be able to read a file he should not have access to.
‫High level identifies of the attacker, can read arbitrary files on the remote host and or can execute
‫commands on it.
‫And critical level vulnerabilities are the most important vulnerabilities for us.
‫These vulnerabilities can be exploited by a tool and in most cases the attacker does not need to make
‫an extra effort to exploit them.
‫So let's fast forward the scan.
‫Now, on the right side of each Ostro, you can see the status of the scan of that post 100 percent
‫means the scan of that hostas complete.
‫Did you know you can ping the hosts sometimes to understand that they're still alive?
‫And finally, our scan is completed in four minutes, which is a very fast scan for a vulnerability
‫scan.
‫Now, let's collect the meta voidable to go to the vulnerabilities of that host.
‫Here are the vulnerabilities of the Métis voidable machine found by this scam.
‫Please note that there might be other vulnerabilities that cannot be found by Nessus with a policy that
‫we used.
‫The vulnerabilities are ordered by severity levels, by default, and I think that's a good idea.
‫The vulnerabilities in a critical severity level are the most important ones for us again.
‫So click on a vulnerability to see the details of it.
‫So here we have the name of the vulnerability, a brief description.
‫A solution method and the links to learn more about it, and last, the host and the port where the
‫vulnerability lives at the right side of the screen, you see some additional and important information
‫about the vulnerability.
‫So for this particular vulnerability, Nessus says that we can exploit it using core impact, which
‫is a commercial and very powerful exploitation tool.
‫And here are the scores of this vulnerability, 10 dot zero is perfect for us.
‫So quick, back to vulnerabilities, you go back to the list of the vulnerabilities.
‫Here there is another vulnerability which says the Ovens server is running on the host and its password
‫is password.
‫If that's true and if there's no additional measure to protect the host, we can access that host very
‫easily.
‫Show you.
‫Let's test it, go to the terminal screen and run the BNC viewer by typing X Vincey viewer and hit enter.
‫If you don't have VMC viewer installed on your Colly type Apte Dash get install x vincey viewer and
‫hit enter.
‫Take the IP address of medicine, voidable as the Vincey server and hit enter.
‫And now type password as the password and hit enter again.
‫And voila, we are in the system.
‫I use the WAMI Linux command to learn the user that I've caught and you name Dash A to learn the operating
‫system and the kernel details if config to see the information about the network interfaces, etc..
‫Now, type R.M. Dash, R.F. Slash, no, no, no, no, just kidding, don't don't do that.
‫Don't.