Now our initial discovery scan and assessment for vulnerabilities took about 10
minutes to run.
And you can see there that there's a check mark indicating that it has
completed.
And again, you can click on that row and see that there are a bunch of
different details that we're going to get out of this.
Now we'll be going more in depth than this in our follow on skills as far as
figuring out what information to take out of this to leverage against those
vulnerabilities.
So that's what we're going to do is go to the left side and go to my scans.
So that way we can do our own scan and not the initial discovery one.
Now this is can be kind of deceiving sometimes because you're going to have to
move left and right.
As you won't see on the top right over here, the new scan icon created a new
scan for whatever it is we want to do.
Why the defaults like this? I'll never know.
Could be the size of the window.
Now the host discovery scan is the one that we just completed that was the
default one after we got NSS installed.
Right below that you can see that we actually have some different vulnerability
scans and for this one we're going to be doing a basic network scan, a full
system scan suitable for any host.
And again, as we go forward, we'll be going into the different rules that's in
collaboration do a more active scan using NSS.
We're going to name this one first scan and don't really need description that
's just there we want to have good notes.
And we're going to save this under the default folder of my scans and we're
going to identify a target.
Now this one we're going to go with 192.168.0.
What's going on our Hyper-V manager real quick and verify which what our window
is.
Under the networking 51.
Go ahead and close that.
Dot to 51 and then I can scroll down just a little bit.
And if we wanted live results this could be a little bit taxing on the system
itself not really necessary for what we want to do.
Now you'll notice over the top there are three tabs.
We're in the settings right now.
You can schedule this out. We're not going to do it. We're just going to run
this right away.
There's also a credential tab and what this is for is if you want to run as a
privileged or just an everyday user actually touching the system.
So for now we're going to leave this alone but know that if we have the
username and passwords for either the system or the domain.
We could run at whatever elevation we need to based on those credentials for
the system itself.
And that third tab for plug-ins. Again we'll come back to this because this is
where we start really getting into the details of what it is we're looking for
inside of a scan.
Let's go back to our settings tab. Go into the discovery portion of this and
you can see that we have a drop down for scan type.
Now we're going to be doing a common ports, common ports and you have a
description for that below.
Basically ports that are commonly used on systems like port 80 or HTTP traffic.
And you can go into the actual assessment and see that there's more information
in there. You can drop down.
Go into scan for known web vulnerabilities that we can do.
We'll go ahead and select that just to get something unique in here.
Under our report we can go into the details of the report itself.
This will make more sense when we actually view the report for this scan.
And in our last section in the advanced we can go and look at the actual timing
on this.
Now we remember this part from our actual discovery using in-map when we were
doing our initial scan of reconnaissance across the actual network.
If we run this at default or if we say a custom level that is really quick.
This is going to generate a lot of traffic in terms of network activity and
could be easily identifiable if we're in the portion of a pen test and wanting
to keep a low profile.
So we want to go scan or you could say scan low bandwidth links.
Set it to custom slow it down.
But right below are the performance options for the default measure.
And that is 30 simulations simultaneous host or simultaneous checks per host.
Five second network read timeout.
Meaning that even though this is not too fast, it's not too slow.
So if we were to actually run wire shark at the exact same time, you would see
four simultaneous checks coming from the tally IP address going to four
different host or going to, yeah, four different host.
Or we can have up to 30 at the same time.
So if you're setting rules for IDS or IPS, be it statically or he, he r
istically, you want to keep an eye out for things like this because one client
like Kelly, if for instance, should not be reaching out to 30 host at the same
time.
That's, that's indication for bad, but going back to basic, make sure our
settings are still there.
We could go ahead and click on save. But if you do the drop down, you could see
also that there's launch, but then there we're going to click on save first.
And then we're going to go or it takes us back to the main window.
And you can see where we have first scan available down on the bottom.
If we move over to the right, you can just hit the play button and it will
launch the scan without having it go to a schedule.
So even if you created a scheduled scan inside of Nessus, you can go at any
time and press the play button to run that specified scan.
If the need occurs.
And that's pretty much how to run a scan.
I'm going to let this run and we'll come back and take a look at the results
and then we'll get a better understanding of what some of those setting means
in terms of what data we get back from the scan.