[Music] what's going on everyone in this video i
want to talk about using Nessus vulnerability scanner
if you're looking to become a security consultant you need to know that using
nessus is going to be a fairly big part of your job especially when you
are doing things like external or internal infrastructure assessments it's
by no means all of your job you should definitely be doing some manual testing
as well but automated vulnerability testing is going
to be something you need to do and in this video i just want to show
you a few of my tips and how i configure nessus
to get a thorough assessment out of it essentially
so if you don't know what vulnerability scanning is with nessus
basically you give it some ip addresses it goes and looks for any services that
are available on those ip addresses or it can log into maybe linux or
windows to find any misconfigurations in the operating system or missing patches
and looks for any vulnerabilities within that basically
so when you log into nessus this is what you will first see this is the dashboard
you can do two things to start an scan you can either go new scan
and use some predefined policies or you can create your own policy which
you could use across many different clients if you're doing
the similar type of thing which you probably will be
so we're gonna make a policy i'm just gonna talk you through some of the
things that i set up um that i can use across all of my
clients so as i said there's many predefined
policies here if you want to do a web application test you can use that one
for example but for this assessment we're going to
go an advanced scan and set a load of different configurations up manually so
new advanced scan you can name whatever you want i'm just going to go example
um the first thing you want to look at is discovery
so this is an important setting straight away ping the remote host
turn it off and the reason you want to turn that off is because if you leave it
on and any ip addresses
that you give don't respond to ping
icmp then you might miss ports that are actually open
so turn it off and it will do a thorough port scan
and find all of the open ports fragile devices you can leave that off because
you don't want to be scanning network printers and
operational technology devices because that could lead to denial of
service and a very unhappy client with you
wake on lan don't need to worry about that either usually
so the ports this is another important selection or configuration
it starts with default these are set and i think etc
services within linux or you can use all which is the full tcp port range
um but in my case i set it like this so you can go
t colon one hyphen six five five three five
and that's scanning the full tcp uh port range
or i also add on a u for udp and add one to 1024 you don't want to be
scanning all of the udp ports because to be honest it's going to take ages to
scan all that and you've got to manage your time on client site so scan all the
tcp ranges it's pretty quick scan some common udp ports to get a good
kind of feel of the vulnerabilities within the network
it's though right enough basically local portal numerators so this is the thing
that actually logs into
windows or linux or whatever device you've got this set to
to look for the misconfigurations with a credentialed scan
so you can leave this as normal that's absolutely fine
network port scanners turn on udp so it will actually look for those udp ports
that we've set using a syn scanner is fine you can use
tcp and that will do a full freeway tcp handshake
but it takes a lot longer and to be honest using a sim port scan
is good enough in this case so just use a sim scan and probably
half your scanning time let's go to service discovery next
you want to probe all ports to find the services and you want to put this
to all ports the reason you want to do that is because sometimes clients will
have um tls services running on non-default
ports and if you don't have all ports they won't be found
so that's not a thorough assessment so have that to all ports
next up let's use the assessment tab and you want to put on perform
thorough tests unless you're using quite a congested network
you definitely want to tick that just to be thorough you can also if you want add
a definition grace period so if you know your antivirus definitions
are uploaded um every seven days or something you can
set that to seven days if you want to i generally just leave that as normal
next up brute forcing only use credentials provided by the
user leave that ticked and we set that within credentials which i'll talk about
in a minute everything else leave the same you don't
want to brute force of hydra and you don't want to brute force oracle
databases and the reason you don't want to do that
usually is because you'll probably end up locking accounts out within the
client domain and again you'll have a very unhappy client so
unless brute forcing is in scope and they want it don't bother doing it
and even if they do want to do it you probably don't want to use necessary
just go ahead and use hydra yourself because
you know there's some there's more flexibility using the command line hydra
scada don't need to worry about that unless you're doing a scarlet job which
is not typical web applications on an infrastructure
assessment it's doubtful that you'll be looking at web applications but if it is
in scope to scan web applications you can turn that on and you can enable
the generic web application tests with all of the methods here
and thoroughly test it so don't stop after the first floor is found
that's a fine configuration to scan web applications but
in general you don't need to scan web applications unless it's in the scope
so i'll turn that off for now windows kind of fine as it is if you want a bit
more information about the domain you can turn that on which i will do
malware we're not looking for malware we're not trying to do some forensic
analysis here so leave that off report
this is a very important one that i think a lot of people
get wrong when they first start using nessus you want to turn this off
because the reason is if you have this ticked
and you scan a linux or linux windows machine
or linux machine you might have a load of patches that are missing
on that machine and that's going to show you all of those patches
when in actual fact usually with things like windows
there will be one top level patch from like
now that will actually patch all of those other patches that are missing
so you don't want to be providing a client with 50 different patches
that are missing you want to provide them with the one patch that will fix
those 50 patches so turn that off basically
and then allow you to edit scan results just so you can play around with them if
you need to and if you want to you can tick this so
basically what that does is instead of looking
at vulnerabilities per ip address it will show you vulnerabilities per host
name and the clients tend to use host names
around their estate rather than ip addresses so this could be useful to you
and to the client but you know if dns isn't set up appropriately or right
that could mess things up so i typically leave that unticked and
if they do want ip addresses and hostnames you can have a look at that
later on and provide them
an excel spreadsheet or something like that of ip addresses to host names
next up advanced don't really have to change anything here other than
performance settings if you know you're going to be on a congested network
you've asked your client if kind of the network's pretty flat
you might want to turn on performance options you might want to put
the simultaneous host to something like 30 or less
it's going to take a long time to scan don't get me wrong but
it's better than dosing the client network and then being unhappy with you
so kind of think about that before you
start the scan you know i've been in cases where i have
not ticked this and the network's pumped very slow
especially when you're trying to scan over wifi and things like that which i'd
never recommend but sometimes you do just have to do that because it's the
way it is and now we have a good policy to start
with if you're doing an external
infrastructure assessment that'd be fine to go ahead and just start scanning with
if you're doing an internal infrastructure assessment you probably
want to actually log into the host that you're scanning
and you can do that using snmp ssh or windows
so if you're scanning a linux host you obviously want to go ssh
and you can use public key authentication or more commonly you'll
be given a root user that can um
well not maybe not a root user maybe a pseudo user an administrative user
basically on linux and you'll put the username password in here you'll put the
sudo username password in there and then you can go ahead and scan linux
with windows very similar you have a local admin or a domain admin
you can put the username and password in there along with the client's domain
and you want to tick these and these so sometimes if you don't take these
they're not already enabled nessus won't scan everything with
privileges and you know you won't get all of the
vulnerabilities you might miss something so that's not a good place to be
and for these top two keep them enabled because
you don't want to be sending credentials in the clear and you don't want to be
sending them
using old authentication mechanisms because it's vulnerable
so once that's all set up you can then go ahead
and do uh internal infrastructure assessment what you might also want to
consider is compliance so there's various different compliance
bodies that kind of set the best practice security
options on windows linux and various other devices
so you can go ahead and pick whatever you want here so you might want to pick
the uh if you're scanning a cisco firewall
maybe you want to check the cisco firewall compliance
guide here versus the configurations on the device that you're scanning
and that will tell you kind of what doesn't match up with the cis
benchmarks for example then you can tell your client you know this
isn't meeting best practice you need to change your setting to this and
gives you a bit more to talk about in your report i tend to not use this but
it's something to consider so with this all created now
we can go ahead and save it and now we can use this across various
clients and to do that you can go new scan
user defined and your policy here and then you have the option to put in
your ip addresses so i'll just put in my ip address for
example here and then you might want to if you're doing this
on your own estate set up a schedule so you can enable a schedule to scan
daily weekly monthly yearly if you want to and that's going to give you
vulnerability analysis kind of an ongoing basis so that's
something to consider as well but if you're doing this kind of
client to client you don't really need to worry about that
you can just put your ip address in click save
and go ahead and scan i'm not going to do that in this instance because i'm not
going to scan myself but what i am going to do is talk about an
example report that i've done previously here for the purposes of
this video so as you can see this is what a report
looks like gives you loads of different critical
high risk medium risk issues one thing you definitely need to know about nessus
is that it really over eggs the risk rating here so
there's a lot of criticals here that aren't really critical
you know i would rate something as a critical risk if it's exploitable
and you're able to really do some damage to a network potentially
there's a lot of things here that don't even have a public exploit and it would
be pretty hard for you know your average joe to go ahead
and exploit so not really a critical in my book but
nevertheless their vulnerabilities they should be
patched so you do have things like adobe flash players that's a third party
software that needs to be patched um you've got
unsupported windows operating systems so things like
server 2008 for example that kind of alerts you that that needs to be
upgraded to a a new windows version not an old one
more third-party software issues and you've got things like this which is
a microsoft patch [Music]
web servers that are outdated basically just various different
vulnerabilities that might be able to be exploited that the client needs to know
about to either patch which is usually the main thing
but there's also misconfigurations like registry key settings that aren't
changed um as well as various other things you
know this this is really good because it gives you
the um installed version and what the supported versions are to
fix this so you could give that to a client
and they could fix it my biggest tip here though
if you're trying to actually do some exploitation is filter the results
go to metasploit exploit framework is equal to true apply that and these
are all of the different things that have
a module within metasploit so if we go to adobe flash player here
we can see that it actually has a metasploit
module here to exploit this version of flash player
so if you do a bit of social engineering with this exploit
and get the exe file onto um the ip addresses that are vulnerable and
someone clicks on it you would be able to gain access to this
machine but yeah i think that's kind of what i
wanted to show you today that's how to set up a nessus scan for thorough
testing and kind of what the example output is
of it hope you learned something here guys
happy hacking thanks for watching give us a like and subscribe
[Music]