Okay, well, we've ran some scans.
We let one of them go first.
Now let's do a compare and contrast and take a look at some of the different
details of
what's going on here.
Now, we did start off by saying we were running a Windows vulnerability only
scan.
And this was identified by selecting the specific plugins for this particular
scan.
First thing I want to point out is that this scan only took two and a half
minutes to run.
And that's because we're not going through the entire arsenal of plugins for
our vulnerability
assessment on a system.
So therefore it's not going to take near as long.
And you notice here that we have one failed and that's for the authentication,
meaning
that the system that we were scanning did not have open authentication because
as you remember,
we did not put any credentials and our configuration for Windows.
And you'll notice that I have one host on here, but a history of two.
And we did come up with one critical.
Now this is the first time I've been taking a look at these results.
So let's go ahead and figure out what's going on.
And this is 247.132.
I'm actually going to go back here and go to the original scan and we'll take a
look at
that one.
We go back to 247.1.
Okay.
And we remember 247.1 was the actual host that all the BMs here are hosted on.
And that's running Windows 10.
Now if I go back into history, you'll notice I have two scans here.
Well I ran another one and that's the current one.
And I ran that against a different kind of Windows system.
And if I go select that one and then go into the actual host, now let's go back
.
Our current is the one that we're actually on for reviewing.
That's been information to know.
Now if we go back to host, you'll see I have 247.132 and one critical.
If I select that and then go into it, you'll see that all the vulnerabilities
come up.
One of them is mixed.
And I can dive even further by clicking on that row and seeing what the actual
critical
was unsupported Windows OS remote.
So we keep diving a little bit further and we can get a whole lot of
information.
The of course we get the CVSS scoring and vectors.
We also get the ID for the plug-in which is on the right side which can give us
more information
if we need to look it up later on.
But this remote version of Microsoft Windows is either missing a source pack or
if no one
is supported.
That's because the version of Windows that I pointed to was in fact Windows 7
Ultimate.
And that's in that VM setup here.
Now in order to do this, what I did was is I went back to the scan and go into
the Windows
vulnerabilities only.
You can actually go on the top right and go to configure and change the IP
address of
the actual target or targets that you want to do this with.
This is usually not a preferred practice.
You just want to be able to create a different scan altogether.
But I don't want to have to go through the waiting of selecting all of those
different
plug-ins again.
So since that's the one that was already configured for me, I used it to fit my
needs
in this particular instance.
We just have to remember that when we go back to summary that we're going to be
seeing
information pertaining to one system, right there.
If I can, I've got my mouse over it.
It's the blue circle.
And it's the pie graph that just says Microsoft Windows 7.
And if I go back to history and change it over to the second scan, the first
one that
we ran, go back in the scan summary, we can see that it now has it identified
as Microsoft
Corporation Windows Media Player, which is totally not an operating system.
Now I did run another scan as well, and I'm trying to get back there for you
real quick,
and this scan was with all plug-ins.
The only reason that I ran this one was to show you a little bit different of a
view as
far as time is concerned.
And this is also going to create that load of traffic that we talked about
while ago,
because all these different vulnerabilities are being pin tested across the
network from
system A to system B.
Now I also want to point out too that depending on your setup, times could take
longer or
shorter.
Sorry about that weird zoom.
But as you can see as I move over, this scan took a little over 11 minutes to
complete.
And that shows us right there that by adding the more plug-ins, the longer that
this is
going to take.
And we also may need to control the throttling of how fast this actual scan
conducts itself
in order for us to be as quiet as possible on the actual network.
Yes, that's a lot of information to take in, but thankfully with the playground
labs that
we have available for the skills and the course overall, we could go in there
and start dabbling
around and making little changes to it to do that comparing the truss based on
whatever
system that we're trying to pin test.
But we're also trying to get the vulnerability assessment to be able to figure
out what it
is that we're going to be leveraging exactly.
That gets brought up because even though Ness's covers a lot of brown, that's
not necessarily
the end all be all as far as vulnerability assessments go.
It's just one of the biggest things that we use in terms of being able to
actively scan
a particular system or device that's within the organization that's within the
rules of
engagements considered as a target.
[BLANK_AUDIO]