(NESSUS: Lesson 5)

{ Scan with Nessus using Kali }

1. What is the purpose of this lesson?
   • In the previous lessons you use NMAP to determine which services were running, using a methodology known as port scanning.  This lesson will teach you how use Nessus to conduct a vulnerability assessment.
   
   
2. What is NESSUS?
   • Tenable Network Security provides enterprise-class solutions for continuous monitoring and visibility of vulnerabilities, configurations, user activity and system events that impact security and compliance.
   
   
   • Nessus features high-speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of your security posture
   
   
3. Pre-Requisite
   • Kali Rolling Edition: Lesson 1: Installing Kali Rolling Edition - 2023
   • NESSUS: Lesson 4: Install Nessus on Kali Rolling Edition
   
   
4. Lab Notes
   • In this lab we will do the following:
     1. Scan Damn Vulnerable WXP-SP2 with nmap
     2. Scan Damn Vulnerable WXP-SP2 with Nessus
     3. Product Nessus Report
     4. Save Nessus Report
   
   
5. Legal Disclaimer
   • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
   • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
   • In addition, this is a teaching website that does not condone malicious behavior of any kind.
   • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
   • © 2024 No content replication of any kind is allowed without express written permission.

1. Start Up VMWare Player
   • Instructions:
     1. Click the Start Button
     2. Type Vmplayer in the search box
     3. Click on Vmplayer
   • 
    
2. Start Up VMWare Player
   • Instructions:
     1. Click the Start Button
     2. Type Vmplayer in the search box
     3. Click on Vmplayer
   • 

    

3. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

    

4. Play the kali2 VM
   • Instructions:
     1. Click on the kali2 VM
     2. Click on Play virtual machine
   • 

    

5. Supply Username and Password
   • Instructions:
     1. Provide username 
     2. Provide password
     3. Click the Log In Button
   • 

1. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Edit Virtual Machine Settings
   • Note:
     • This VM is running Windows XP.
     • This is the Victim Machine that we will be scanning with Nessus.
   • 

    

2. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
     3. Click the OK button
   • 

    

3. Start Up Damn Vulnerable WXP-SP2
   • Instructions:
     1. Start Up your VMware Player
     2. Play virtual machine
   • 

    

4. Logging into Damn Vulnerable WXP-SP2
   • Instructions:
     1. Click Administrator
     2. Supply Your Password
     3. Click On
   • 

    

5. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 

    

6. Obtain the IP Address
   • Instructions:
     1. ipconfig
     2. Record Your IP Address
   • Note(FYI):
     • #1, (ipconfig) displays all current TCP/IP network configuration values.
     • #2, In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.1.96.
   • 

1. Open a Terminal Emulator
   • Instructions:
     1. Click the Kali Icon in the upper left corner
     2. Search for the string root terminal
     3. Click on the Root Terminal Emulator Icon
   • 

    

2. Authentication
   • Instructions:
     1. Supply Password
     2. Click the Authenticate Button
   • 

    

3. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
     2. Record your IP Address
   • Note(FYI):
     • My IP address 192.168.1.94.
     • In your case, it will probably be different.
     • Run "dhclient -v" if you do not have an IP address.
   • 

    

1. NMAP OS Detection and Service Discovery
   • Instructions:
     1. nmap -O -sV 192.168.1.96
     2. Observe the detected ports and their services
     3. Observe the detected Operating System
   • Note(FYI):
     • Arrow #1: (nmap) is a network mapping tool, that is using the (-O) flag to detect the operating system and (-sV) to detect the service associated with the particular port on the vulnerable device (e.g., 192.168.1.96). 
     • Replace (192.168.1.96) with the IP of your Damn Vulnerable WXP machine found in (Section 2, Step 6).
   • 

    

2. Using smb-vuln-ms08-067.nse
   • Instructions:
     1. nmap --script smb-vuln-ms08-067.nse -p445 192.168.1.96
     2. nmap believes this machine is vulnerable
   • Note(FYI):
     • Arrow #1: (nmap) is using a NSE script (e.g., smb-vuln-ms08-067.nse)over port (-p445) to determine if the device (e.g., 192.168.1.96) is vulnerable to MS08-067.
     • Replace (192.168.1.96) with the IP of your Damn Vulnerable WXP machine found in (Section 2, Step 6). 
     • The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks.
   • 

1. Start Nessus Service
   • Instructions:
     1. systemctl start nessusd
     2. ps -eaf | grep nessus | grep -v grep
     3. netstat -naop | grep nessus
   • Note(FYI):
     • Arrow #1: Use (systemctl) to control the systemd system and service manager.  In this case, we are using (systemctl) to start the nessus daemon (e.g., nessusd).
     • Arrow #2: Use (ps -eaf)to show me all the processes.  Use (| grep  nessus) to search for all nessus processes.  Use (| grep -v grep) to no display the actual grep process.
   • 

1. Start Firefox Instance
   • Instructions:
     1. Click the Kali Icon
     2. Search for firefox
     3. Click the FireFox ESR Icon
   • 

    

2. Enable Menu Bar
   • Instructions:
     1. Left Click by the Home Icon
     2. Select the Menu Bar
   • 

    

3. Enter Setting
   • Instructions:
     1. Select Edit
     2. Select Settings
   • 

    

4. Configure Downloads
   • Instructions:
     1. Search for downloads
     2. Select Always ask you where to save files
   • 

1. Invalid Certificate Warning
   • Instructions:
     1. Navigate to https://127.0.0.1:8834/
     2. Click the Advanced button
     3. Click the Accept the Risk and Continue button
   • 

    

2. Login To Nessus
   • Instructions:
     1. Login: student
     2. Password: Supply Password
     3. Click the Sign In Button
   •  

    

1. Create Folder
   • Instructions:
     1. Click the New Folder button
     2. Name: hackingdo
     3. Click the Create button
   • 

    

2. Create New Scan
   • Instructions:
     1. Click on the hackingdo folder
     2. Click the New Scan button
   • 

    

3. Select Scan Template
   • Instructions:
     1. Click on Advanced Scan
   • 

    

4. New Basic Network Scan Policy
   • Instructions:
     1. Name: Damn Vulnerable WXP
     2. Folder: hackingdo
     3. Targets: 192.168.1.96
   • Note(FYI):
     1. The IP for my Damn Vulnerable WXP machine is 192.168.1.96.  Your IP address will most likely be different and can be retrieved from (Section 2, Step 6).
   • 

    

5. Assessment
   • Instructions:
     1. Click Assessment
     2. Select Windows
     3. Check Request information about the SMB Domain
     4. Click the Save Button
   • 

    

6. Run Scan
   • Instructions:
     1. Click on the hackingdo folder
     2. Click on the Arrow Assessment
   • 

    

7. Scan in Progress
   • Instructions:
     1. The Arrow changing to a Pinwheel signifies that the scan is running
   • Note(FYI):
     1. The scan will take between 5 to 10 minutes to run.
   • 

    

8. Scan Completed
   • Instructions:
     1. The Arrow will change from a Pinwheel to a Checkmark once complete.
     2. Click on the "Damn Vulnerable WX" Scan name.
   • 

    

9. View Vulnerabilities
   • Instructions:
     1. Notice the Severity summary of vulnerability counts
     2. Click on number in the Vulnerability tab
   • 

    

10. Expand Vulnerability List
    • Instructions:
      1. Click on the Gear Icon
      2. Select Disable Groups
    • 

     

11. Select MS08-067
    • Instructions:
      1. Click on MS08-067
    • 

     

12. View MS08-067 Vulnerability
    • Instructions:
      1. Observe the Title
      2. Read the Description
      3. Scroll Down
    • 

     

13. Exploit Information
    • Instructions:
      1. Exploits are confirmed to exist
      2. A Metasploit module exists for this vulnerability
    • Note(FYI):
      1. Naturally, the next step as a penetration tester would be to attempt the Metasploit exploit module for this vulnerabilty.
    • 

     

14. Access Report
    • Instructions:
      1. Click on the hackingdo folder
      2. Click on the Damn Vulnerable WX scan
    • 

     

15. Export and Create Report
    • Instructions:
      1. Click on the Report button
      2. Click on CSV radio button
      3. Click on Select All
      4. Click on the Generate Report button
    • 

     

16. Name and Save Report
    • Instructions:
      1. Name: DVWXP_1.csv
      2. Click on the Save button
    • 

     

17. Export and Create Report
    • Instructions:
      1. Click on the Report button
      2. Click on CSV radio button
      3. Click on Select All
      4. Click on the Generate Report button
    • 

     

1. Proof of Lab
   • Instructions
     1. Click on the in use Terminal Icon
     2. cd /home/student/Downloads
     3. ls -l *.csv
     4. grep -i "ms08-067" DVWXP_1.csv
     5. date
     6. echo "Your Name"
        • Put in your actual name in place of "Your Name"
        • e.g., echo "John Gray"
   • Proof Of Lab Instructions:
     1. Press the PrtScn key
     2. Paste into a word document
     3. Upload to Moodle
   •