So let's take just a moment and pretend that none of these plugin families are
actually showing up.
I apologize for the headset. Totally forgot it was on.
Well, that's okay because we can actually install, download, and install
plugins offline.
And we're going to walk through this real quick because we may be in an
environment where
Nessus is not necessarily connected to the rest of the internet for whatever
reason your pen test
may determine. Now, I'm going to go back to a website that we've had before and
I pulled this
up and you may remember this from when we actually downloaded Nessus initially
when we began this
last skill. Well, in this platform area right here that I just opened up, I'm
going to scroll all
the way down to the bottom and then zoom in for us and you'll see where it says
Nessus updates.
And this is the actual plugin directory file that we would download if we
wanted to perform an
offline plugin update for Nessus overall. And once we download that, I have the
command,
the link and command for this below because it's a terminal command that you
would run.
And I would definitely encourage you to be able to practice this inside of the
actual lab that's
associated with this course. But we're going to kind of skip past that because
we want to go
straight into what we really want to talk about here. And that is understanding
which plugins that
we're using for which particular scan. Now we can actually go through and turn
some of these on or
off. And the reason we would want to do that is is let's say we want to make
our scans run a little
bit faster because I'm going to go back for just a second and go back and show
you these scans here
real quick. By default, all of the plugins are turned on. Now if you're
scanning a Windows system
that's belonging to Microsoft, it would go back into our advanced scan again,
go into plugins.
Why would we necessarily need Cisco to be in our plugin family that's available
to us for
this vulnerability assessment? We may be limited on time and we may not want to
scan for all these
thousands of different vulnerabilities and speed up the scan overall or try to
keep our footprint
to a minimal on the actual network and evade those IPS or IPSs out there. So we
could just simply
click on the Cisco enabled button and you can see that it just turned gray. And
that's because
that disabled the actual plugin family for Cisco. Now while that's being said,
we can also go up
to the top right where our search bar is. I'm going to pop out and show you
that real quick.
Let's zoom in and we can see up there where there is a filter next to the
actual search plugin
family's text bar. Yep, there we go. So I'm going to click on the filters and
you can see here now
that when I do the dropdown, we have many different ways to be able to categor
ize this.
Now I'm going to select plugin ID. And if we remember by going back to our
other website here,
we'll click on this up and then go over to the critical that we found a while
ago.
You'll remember that this plugin ID was NSSIS plugin ID 100 464. And that's the
one we want
to verify that it's inside of our plugin directory inside of SSSIS. So I'm
going to search for
plugin ID is equal to 100 464 and do an apply. Now this may take a second
depending on the amount
of resources that we have available to our Kali system, be it on physical or
virtual environments.
And you'll see that what popped up was it's one family on the left and nothing
on the right.
Fear ye not because once you select that plugin family, you'll see that right
there that plugin
ID of the actual plugin itself has now become available to us. And you can
click on it in there
as well and get the same information that we got from the actual website
concerning this particular
plugin along with all the information that is relevant to us to include the CVS
S scoring and
information for vectors. And you could even get into the references that have
their links to them
based on the actual CBE that's associated to it. Now I'm going to close this
and go back to my
filter and show you that you can actually search based on there we go CBE as
well along with
the CVSS scoring and vectors. Now this becomes important because you may be
deciding to search
for a vulnerability that's accessible through network only with a low
difficulty of success.
If you once you understand the CVSS scoring and vectoring, you'll be able to
search for
plugin IDs that match that particular mission set. But in this particular
instance, I'm going to
clear the filter and hit apply. Well, I'm just gonna get clear filters. And
since we're only
scanning a Windows system of 192.168.247.1, I'm going to go through and disable
all the families
except for the ones that belong to Windows. Now I'll scroll down and pause
while I do all the
others. But I wanted to show you that the last three on here, Windows, Windows
Microsoft bulletins
and Windows user management are the three families available to us for actual
Windows itself.
And if I scroll up inside of here and look for Microsoft, you'll notice that it
's not in there.
Everything falls under Windows at this particular point. But they do have other
operating systems
there like Mac and Unix and Linux and other great things. So I'm going to
disable all of these,
come right back and then we'll finish configuring our scan for 247.1, only
pertaining to those
particular plugin families that belong to Windows. Now that I have all that
done, let's go ahead
go back over to settings, make sure that I didn't forget anything, which I did
because I apparently
had to restart this for a second. 247.1 is my target. And the name I'm going to
do for this is
Windows, Bono, or abilities. And I totally didn't misspell that and edit to
where you didn't see it.
It was right 100% of the time, 60% of the time. But once we have that name put
in and our target
identified, we can go to credentials and type in any credentials that we may
want to. And this is
where we can actually go in, come on mouse, you can do it. And we can select
the actual Windows
right there. And that's the information tab for it. Sorry. And once I select it
, you can see that
we're, we have options available to us. We can choose how we would like to log
in to this particular
Windows workstation. And if you have a username and password that you'd like to
enter either for
the individual workstation or domain itself, you can put that in here as well.
Because there is
an option for username, password and domain. Now there are many other options
in here as well,
but I would encourage you to explore, but we're going to skip this for now and
just focus on scanning
with those particular plugins. And once I have all the basics that we won't
done,
I'm going to hit save and then go back to the actual, sorry, I have to remove
this because I
added it by the stage. So let's go ahead and remove the credentials of Windows.
It didn't save and
go ahead and run it. Now as an FYI, before we actually get into the next
portion of the skill
and run it, I wanted to show you that the directory here that has all of the
plugins available to it
is massive. And I'm going to put the actual directory for below because this
will be where that offline
plugin definition set goes into just in case you need to be able to do this
offline. And knowing
this directory is pretty good tidbit knowledge for us to be able to go through
and make sure that we
do have plugins available to us. So within out of the way, we see that our scan
is built and we
also see that it's an on demand scan. If we go in here and click on it, you can
see on the top right
that we have the launch option. Well, I'm going to go ahead and launch because
we've already identified
a target with it. And you can see that it's running. Now that we know that
there are three
plugin families associated with this particular scan. And even though it's for
one IP address,
it's going to take a minute. And that's something we're going to come back to
and look at the results
in the next portion of the skill.