[Ex094]

Hello Guys! In this tutorial I'm am going to discuss about how you can find out Vulnerabilities using Nessus, We are going to do the following steps in the tutorial:

- What is Nessus?
- Installing Nessus
- Starting Up Nessus
- Scanning Target for Vulnerabilities
- Exploit Target
- Using Nessus for your own advantage
- Tune Nessus Scans


What is Nessus?

Nessus is a worldwide popular comprehensive vulnerability scanner. Using nessus you can find out the potential vulnerabilities in your system. Nessus can scan for the following type of Vulnerabilities:

Code:

- It scans a PC for vulnerabilities that can allow a Hacker to exploit the system, Gain access and steal sensitive data. - It searches the target system for missing patches that may get exploited by a hacker - Nessus can launch dictionary scan against passwords to see how strong they are as sometime users do keep common passes that might lead to easy access by a Hacker - It can search for potential threats against DOS attacks by preforming tests on the system

Installing Nessus

For Windows Users: You can download Nessus from here http://www.tenable.com/products/nessus/s...ing-system. After installation you will be required to enter the Activation Key, so don't get confused. Simply goto http://www.tenable.com/ and register an account there, then sign up for a Nessus Key. You'll receive the Key via Email.

For Linux Users: Linux users can download the respective package from here http://www.tenable.com/products/nessus/s...ing-system

After downloading the package, Open a terminal and type the following command:

Code:

sudo dpkg --install package_name.extension

After installing it, you now have to add a User who will use Nessus so for that type this command:

Code:

sudo /opt/nessus/sbin/nessus-adduser

When done, now you need to enter the Activation Key:

Code:

sudo /opt/nessus/bin/nessus-fetch --register "your key"

Where to get the Key?

Go to this link and register for HomeFeed Subscription

Now you have installed Nessus on linux, If you face any problem feel free to PM me or post a comment regarding it

Starting Up Nessus

After installing Nessus, it's time to start it up. Open a terminal and type the following command:

Code:

sudo /etc/init.d/nessusd start

This will start Nessus service on Linux. Now after you have started the service it's time to access the main interface via the Nessus service IP and port from a browser. Nessus starts it service at port 8834 on your localhost so in your browser type:

Code:

https;//127.0.0.1:8834/

You are going to see this page:



In the respective fields enter your Username and the Password that you had set previously.

Understanding The Basic Interface:

After signing in to the main HTML5 interface of Nessus, you'll have it like this (The scans won't be there as you haven't done it yet):



The Result section give you everything about the results of your scans, as you can see in the image there are already some scans present and it's infact the Result page. Whenever you perform a scan, your results appear in this page.

The Scan section will tell you about on going or scans that are on hault or scheduled for later usage. To start a new scan you will have to use that section.

The Template section lets you make a common template for a scan, This is a new feature and there are currently 4 template policies which we will discuss in the upcoming section.

The Policies section lets you edit the policies for your needs, in this section you can enable or disable the choice of Vulnerability detection. This section basically lets you customize the policy of your scan template.

The User section lets you add more users that you want to have access to the nessus main panel.

The Configuration section is where you can set web proxy for nessus updates, Advanced setting, Mobile access etc

The Upload button lets you upload an already present result file on your PC in nessus for review

Types of Policies Templates For Scanning

The newest version of Nessus offers a new feature called Templates which allow you to scan a target by choosing a specific template, Nessus Offers 4 policies
which are:

Code:

- Internal Network Scan - External Network Scan - Web App Tests - PCI-DSS Audits

The Internal Network Scan allows you to run a scan and find out the vulnerabilities on your PC's inside your network like LAN. This scan is useful for the cause when you are in charge of a Company's Private Network and you want to keep all the systems in the network clear of any vulnerability

The External Network Scan is related to the host external host having fewer services related to the network, most of the plugins present n the Web Application Test are enabled in this policy like CGI Abuse etc.

The Web App Tests have been specifically designed for your system to detect both Known and Unknown vulnerabilities. Here's some more from the Nessus document:

Code:

The fuzzing capabilities in Nessus are enabled in this policy, which will cause Nessus to spider all discovered web sites and then look for vulnerabilities present in each of the parameters, including XSS, SQL, command injection and several more.

This PCI DSS Policy enables the built-in PCI DSS compliance checks that compare scan results with the PCI standards and produces a report on your compliance posture. It is very important to note that a successful compliance scan does not guarantee compliance or a secure infrastructure. Organizations preparing for a PCI DSS assessment can use this policy to prepare their network and systems for PCI DSS compliance - Nessus

Now that you understand the Nessus policies for scanning it's targets, we shall now perform our first scan using Nessus!

Scanning Your Target with Nessus:

Open the Nessus main panel, Now click the "Scan" button and then you will be promoted to the Scan Section. Then Press the "New Scan" Button. Now lets get familiar with the New Scan Interface:



Scan Title can be any name you want to choose for your scan, remember to use different name so that you can manage these scans with ease.

Scan Type give's you two options, Either to run the scan right away or to run it later according to your schedule.

Scan Policy has been discussed already and I think it's up to you to decide which Policy you choose for your target, If you haven't understood the policies go back and read them again.

Scan Targets is where the IP's of your targets goes.

Upload Target should be used only when you want to have a mass target scan ( MANY TARGETS ).

OK So I'm going to preform a random scan on one of my LAN system so the settings are:

Target IP: 192.168.0.102

Scan Policy: Internal Network Scan (Because the system is present inside my LAN Network )

Scan Type: Scan Now (No Patience )

Press the "Create Scan" and let it do it's job, remember it may take hours for Nessus to complete the scan depending upon the amount of vulnerabilities in it's database to be tested against the target system, So Be Patient!

The Scan Result

After your scan is done, the result of that scan will be present in the Result section. Go to the Result section and click on the respective Scan Title which you named it earlier. Then you are going to get this:



The image above represents the Host Scan, the color bar's with numbers are the number of Vulnerabilities that the scan has detected. Each type of vulnerability has a color code of it's Intensity level. For example Red is for HIGH Level Vulnerability, Orange for MEDIUM Level and GREEN for LOW Level Vulnerability.

Here's an sample output:



(Vulnerability found from Damn Vulnerable Linux)

The grey boxes are just general information like traceroute, service detection, nmap scans and etc. You can also see the Severity Level boxes, the name of the vulnerability or weakness are present infront of the box, also present is the genre of the vulnerability either it falls in the General, Service etc category

You can get the information about each vulnerability by pressing the respective vuln.

Exploiting the Vulnerability

As a vulnerability scanner, Nessus gives detailed report about it's vulnerability finding. The description is pretty understandable for the vulnerability and with it gives the solution of the vulnerability too. For example I have a vulnerability TLS CRIME Vulnerability so if you click the vulnerability it'll give you all the details about it including whether a exploit is publicly available or not, It's overall severity rating and more, For example:



It also tells you whether your exploit is available in public or not, This is very important for many administrator as it's better that you patch the vulnerability before an exploit is available publicly.



As you can see that my vulnerability exploit is available for public so I'm in trouble otherwise someone might find it and exploit it.

Using Nessus For your Own Advantage

For me Nessus is a perfect vulnerability scanning tool using which you can protect yourself too. For that just scan your OS regularly with Nessus, When you encounter any type of vulnerability either it's of Low or Info type. Just follow the instructions given in the solution of the vulnerability and patch it. Remember that Nessus might not give solution for every vulnerability, For that you'll have to do a bit of Googling.

Tuning Nessus Scan

For me, Nessus didn't require any changes in configuration or settings, it worked pretty well on the first try and still does. One word of advice is that if you proceed in scanning an online website or server be sure to change the threads, IT'S ADVISED THAT YOU DO NOT CHANGE THE SETTINGS AT ALL. If you plan on changing it please read the proper documentation which is posted on the Nessus Official Website http://www.tenable.com/products/nessus/documentation

Here my Nessus Guide ends, I hope this helps you all
For any mistake, problem just PM me
Regards,
Ex094

[Ex094]

Hello Guys! In this tutorial I'm am going to discuss about how you can find out Vulnerabilities using Nessus, We are going to do the following steps in the tutorial:

- What is Nessus?
- Installing Nessus
- Starting Up Nessus
- Scanning Target for Vulnerabilities
- Exploit Target
- Using Nessus for your own advantage
- Tune Nessus Scans


What is Nessus?

Nessus is a worldwide popular comprehensive vulnerability scanner. Using nessus you can find out the potential vulnerabilities in your system. Nessus can scan for the following type of Vulnerabilities:

Code:

- It scans a PC for vulnerabilities that can allow a Hacker to exploit the system, Gain access and steal sensitive data. - It searches the target system for missing patches that may get exploited by a hacker - Nessus can launch dictionary scan against passwords to see how strong they are as sometime users do keep common passes that might lead to easy access by a Hacker - It can search for potential threats against DOS attacks by preforming tests on the system

Installing Nessus

For Windows Users: You can download Nessus from here http://www.tenable.com/products/nessus/s...ing-system. After installation you will be required to enter the Activation Key, so don't get confused. Simply goto http://www.tenable.com/ and register an account there, then sign up for a Nessus Key. You'll receive the Key via Email.

For Linux Users: Linux users can download the respective package from here http://www.tenable.com/products/nessus/s...ing-system

After downloading the package, Open a terminal and type the following command:

Code:

sudo dpkg --install package_name.extension

After installing it, you now have to add a User who will use Nessus so for that type this command:

Code:

sudo /opt/nessus/sbin/nessus-adduser

When done, now you need to enter the Activation Key:

Code:

sudo /opt/nessus/bin/nessus-fetch --register "your key"

Where to get the Key?

Go to this link and register for HomeFeed Subscription

Now you have installed Nessus on linux, If you face any problem feel free to PM me or post a comment regarding it

Starting Up Nessus

After installing Nessus, it's time to start it up. Open a terminal and type the following command:

Code:

sudo /etc/init.d/nessusd start

This will start Nessus service on Linux. Now after you have started the service it's time to access the main interface via the Nessus service IP and port from a browser. Nessus starts it service at port 8834 on your localhost so in your browser type:

Code:

https;//127.0.0.1:8834/

You are going to see this page:



In the respective fields enter your Username and the Password that you had set previously.

Understanding The Basic Interface:

After signing in to the main HTML5 interface of Nessus, you'll have it like this (The scans won't be there as you haven't done it yet):



The Result section give you everything about the results of your scans, as you can see in the image there are already some scans present and it's infact the Result page. Whenever you perform a scan, your results appear in this page.

The Scan section will tell you about on going or scans that are on hault or scheduled for later usage. To start a new scan you will have to use that section.

The Template section lets you make a common template for a scan, This is a new feature and there are currently 4 template policies which we will discuss in the upcoming section.

The Policies section lets you edit the policies for your needs, in this section you can enable or disable the choice of Vulnerability detection. This section basically lets you customize the policy of your scan template.

The User section lets you add more users that you want to have access to the nessus main panel.

The Configuration section is where you can set web proxy for nessus updates, Advanced setting, Mobile access etc

The Upload button lets you upload an already present result file on your PC in nessus for review

Types of Policies Templates For Scanning

The newest version of Nessus offers a new feature called Templates which allow you to scan a target by choosing a specific template, Nessus Offers 4 policies
which are:

Code:

- Internal Network Scan - External Network Scan - Web App Tests - PCI-DSS Audits

The Internal Network Scan allows you to run a scan and find out the vulnerabilities on your PC's inside your network like LAN. This scan is useful for the cause when you are in charge of a Company's Private Network and you want to keep all the systems in the network clear of any vulnerability

The External Network Scan is related to the host external host having fewer services related to the network, most of the plugins present n the Web Application Test are enabled in this policy like CGI Abuse etc.

The Web App Tests have been specifically designed for your system to detect both Known and Unknown vulnerabilities. Here's some more from the Nessus document:

Code:

The fuzzing capabilities in Nessus are enabled in this policy, which will cause Nessus to spider all discovered web sites and then look for vulnerabilities present in each of the parameters, including XSS, SQL, command injection and several more.

This PCI DSS Policy enables the built-in PCI DSS compliance checks that compare scan results with the PCI standards and produces a report on your compliance posture. It is very important to note that a successful compliance scan does not guarantee compliance or a secure infrastructure. Organizations preparing for a PCI DSS assessment can use this policy to prepare their network and systems for PCI DSS compliance - Nessus

Now that you understand the Nessus policies for scanning it's targets, we shall now perform our first scan using Nessus!

Scanning Your Target with Nessus:

Open the Nessus main panel, Now click the "Scan" button and then you will be promoted to the Scan Section. Then Press the "New Scan" Button. Now lets get familiar with the New Scan Interface:



Scan Title can be any name you want to choose for your scan, remember to use different name so that you can manage these scans with ease.

Scan Type give's you two options, Either to run the scan right away or to run it later according to your schedule.

Scan Policy has been discussed already and I think it's up to you to decide which Policy you choose for your target, If you haven't understood the policies go back and read them again.

Scan Targets is where the IP's of your targets goes.

Upload Target should be used only when you want to have a mass target scan ( MANY TARGETS ).

OK So I'm going to preform a random scan on one of my LAN system so the settings are:

Target IP: 192.168.0.102

Scan Policy: Internal Network Scan (Because the system is present inside my LAN Network )

Scan Type: Scan Now (No Patience )

Press the "Create Scan" and let it do it's job, remember it may take hours for Nessus to complete the scan depending upon the amount of vulnerabilities in it's database to be tested against the target system, So Be Patient!

The Scan Result

After your scan is done, the result of that scan will be present in the Result section. Go to the Result section and click on the respective Scan Title which you named it earlier. Then you are going to get this:



The image above represents the Host Scan, the color bar's with numbers are the number of Vulnerabilities that the scan has detected. Each type of vulnerability has a color code of it's Intensity level. For example Red is for HIGH Level Vulnerability, Orange for MEDIUM Level and GREEN for LOW Level Vulnerability.

Here's an sample output:



(Vulnerability found from Damn Vulnerable Linux)

The grey boxes are just general information like traceroute, service detection, nmap scans and etc. You can also see the Severity Level boxes, the name of the vulnerability or weakness are present infront of the box, also present is the genre of the vulnerability either it falls in the General, Service etc category

You can get the information about each vulnerability by pressing the respective vuln.

Exploiting the Vulnerability

As a vulnerability scanner, Nessus gives detailed report about it's vulnerability finding. The description is pretty understandable for the vulnerability and with it gives the solution of the vulnerability too. For example I have a vulnerability TLS CRIME Vulnerability so if you click the vulnerability it'll give you all the details about it including whether a exploit is publicly available or not, It's overall severity rating and more, For example:



It also tells you whether your exploit is available in public or not, This is very important for many administrator as it's better that you patch the vulnerability before an exploit is available publicly.



As you can see that my vulnerability exploit is available for public so I'm in trouble otherwise someone might find it and exploit it.

Using Nessus For your Own Advantage

For me Nessus is a perfect vulnerability scanning tool using which you can protect yourself too. For that just scan your OS regularly with Nessus, When you encounter any type of vulnerability either it's of Low or Info type. Just follow the instructions given in the solution of the vulnerability and patch it. Remember that Nessus might not give solution for every vulnerability, For that you'll have to do a bit of Googling.

Tuning Nessus Scan

For me, Nessus didn't require any changes in configuration or settings, it worked pretty well on the first try and still does. One word of advice is that if you proceed in scanning an online website or server be sure to change the threads, IT'S ADVISED THAT YOU DO NOT CHANGE THE SETTINGS AT ALL. If you plan on changing it please read the proper documentation which is posted on the Nessus Official Website http://www.tenable.com/products/nessus/documentation

Here my Nessus Guide ends, I hope this helps you all
For any mistake, problem just PM me
Regards,
Ex094

[chmod]

Yet again a quality tutorial keep it up mate

[3r3bus]

Brilliant tutorial my dear friend, we love you <3

[Ex094]

Brilliant tutorial my dear friend, we love you <3

Glad you all liked it I love ya guys too

[bladedemon]

Indeed, great tutorial. :ok:

[bladedemon]

Indeed, great tutorial. :ok:

[ilvae]

Nessus does not support Windows 7?

/edit
Ok my bad I didn't read. Got it! Thank you so much for this!!!

[Ex094]

Nessus does not support Windows 7?

Yes I does support Windows 7, It supports multiple platforms

[soldi3r]

Outstanding tut bro.. you just gave complete view of vuln scanning n exploiting it..