Now that our scan is complete, let's go ahead and go into first scan and see
that we have a report here.
Now this is just the scan summary and showing us the basically the
vulnerabilities in critical high, medium, and low for all hosts that were
scanned.
Now just so happened that we only had one host scanned here.
So, and you can tell because on the next half over you see host one.
Now, vulnerabilities, 18, and then history one, meaning the scan, the one that
we have configured has a history.
And if we ran the scan multiple times, we would be listed here under history.
But in our scan summary, you can even see how long it took.
There was a failed here for authentication.
And that's because we did not put anything inside of the actual credentialing
for Windows.
But as you scroll down, you start to get some of the details of this system are
in terms of like how we ran the scan.
We did a SIM scan.
Basically, this is all the information that we went through when we were going
to figure in the scan for a synopsis of how it was ran against the system.
Just in case we need that data for later.
Under host, you can actually go through and get a nice graphical view.
Those folks in the C suite upstairs, they love this one.
Basically break down one medium one low and all the info is based on the pretty
little colors.
And inside of the vulnerabilities is where we really start to get into thing
here.
Because the vulnerabilities are going to be listed by default from most severe
all the way down to info, which is just basically saying,
hey, this is a concern of minor cause and we just want to provide you with a
little bit of info for it.
Doesn't even warrant low.
But if you'll notice something here, that there is a CVSS score with that.
Now, I'm not worried about the other scores.
We're focusing only on CVSS.
Now, for those that took CYSA, you'll know that the CVSS score is very
important.
You could derive a lot of information on a vulnerability just based off of that
.
And I'll have a link below to that particular skill if you're interested.
Because you can actually go into, let's say this medium here, scroll down just
a little bit, go to the right and have your CVSS breakdown for 3.0 and 2.0.
Number 3.0 is the current. And let me right there.
Sorry, right there.
The entirety of how a vulnerability can affect a system. Again, based off the
CVSS score.
Going back to the left, we are always given information concerning a
vulnerability.
The description of what it is and a possible solution as well with follow on
links.
Now, this is all based on the information that NESSES researches and puts
inside of their definitions.
If you scroll down, there may be more information concerning this particular
vulnerability.
And there is for this one of an output.
Now, this overall vulnerability was based on SMB, signing not required.
Meaning that you can send a box back and forth for data transfers that are not
required to be usually signature.
And you can see that the fourth that this was affected in particular was 4445
and TCP CIFS, meaning file transfers in particular.
We're not going to go to in the weeds on this.
I just wanted to point out what it looks like when you actually complete a scan
.
So that way, moving forward, when we get into more until that scan, we know
what it is that we're looking at when we do the actual breakdown of our
individual systems.
Up at the top, you'll see under first scan, you'll also see the plugin and the
number with it.
When we get into the skill following skill covering the advanced usage of NESS
ES active as an active scanning platform, that plugin number will make a lot of
sense.