So it was pretty straightforward to our challenge. We are going to pick two
plugin IDs to specifically scan for those.
And I'm going to do it against two of the systems that we've identified
throughout this skill already.
It's up to you at home if you want to be able to scan against one system or
more than one.
So let's go ahead and jump on over. All right, so I'm going to go ahead and
select a new scan for this one.
And we're going to call this a pinpoint scan when this actually loads up. Keep
in mind that this is a bit resource intensive.
So if you see that it's dragging a little bit like this, if you're in your
virtual environment, allocate more resources if available.
We're going to go into advanced scan. We'll put in our name pinpoint.
And then we're going to identify this one for two IP addresses 192.168.247.1
and comma 192.168.247.132.
I'm going to go to my plugins tab and I'm going to go through and disable all
of these.
Easiest way to do is probably on top right to stay able to say, well, all that
we're going to go into filter.
And then we're going to look for plug in ID.
And the first one that we're going to be looking for is 139 491.
And I'm going to hit the plus button next to this to be able to add another
filter line for again, another plug in ID.
And I'm going to add in the next one, which is 143 572.
Now I do want to add here also that before we continue this, I'm going to add
another line real quick and show you as well.
Along with the plugin ID, we can search for KVs as well for Windows in
particular.
And the reason that might be a better option, depending on what it is that you
're searching for is because there may be multiple plugin IDs assigned to a
specific KB or vice versa.
You may have one we've seen a lot just on the basic scans that we've done the
SMB vulnerability that's popped up as I click a fly on this.
But it is possible that there are CDEs, KBs and other identifiers that can be
searched for in the filter that pop up as a
method of search, but have more than one ways for them to be able to be checked
against the actual targeted system.
So I went ahead and applied my filter and as you can see, the two on the right
are disabled, but they do meet our criteria of searching by
plugin ID. So now I'm just going to go ahead and on the top of the disabled
portion.
Enable them just like that. And now we can go ahead and go back to our settings
to make sure that our IPs stayed in place.
Go back down to where it says, say, go down and I'm going to launch at this
point. So we're having two IP addresses scanned for two specific
plugin IDs. And this may come in handy for us later on as we may only want to
test against one vulnerability in particular for a certain kind of exploit that
we have in store later on.
Some of that information that we are able to use comes from the reconnaissance
phase of the pen testing lifecycle where we're able to get data from things
like in-map.
And we run across, let's say, a system that has IIS on it and we can look up
plug in IDs that are very specific to IIS or maybe even other things like
Apache.
So I'm not trying to time out just one particular operating system and service.
We can do multiples. And that's the beauty of being able to go in and use
specific plug in IDs.
Now, this is going to take just a minute to run. So I'll be right back after it
finishes. And just like that, we've already completed our scan.
And I'm just taking a look at one of the hosts here.
And it was two minutes, 37 seconds, pretty quick to do.
And we came back with no results found, meaning that that those two plugins
were not identified as being vulnerabilities on the target system or systems.
Now, I also want to close out by showing you now that we know how to do
specific scans, why it's critical that we are able to do some of these critical
or pinpoint scans and customize a lot of the features within some of these that
's a scan.
If I go back to my scans and I'm going to go to all plugins,
I'm going to go ahead and open up Wireshark and go into E.
Zero. And go ahead and make sure,
matter of fact, let me stop and make sure that that's in for misused mode.
It is. And go ahead and start.
Now go back into Nessus and go ahead and launch the scan.
And go back into Wireshark.
We notice already that there's a lot of traffic that was just generated.
And it's going to and from our system to the target system that's being
targeted.
Now, you'll notice that a lot of these are purple, red, yellow, a whole bunch
of different colors within Wireshark.
If an IDS or IPS is on the actual network and doing its job, scans like this
are going to be picked up pretty easy.
In fact, you can see right here within this packet,
let me pop out and zoom in for you real quick, that this DNS packet coming from
,
I'll have to expand the layer three header on this, but it's actually plugins.
nesus.org, meaning that it's already tagged as being a necessary scan.
And if we extend the layer three header, we'll see that we're going from one to
eight destinations just about two, which is our gateway.
So it's seeing our network is seeing traffic being generated from our scanning
system and packets like this are an indication to the blue team that's supposed
to be doing proper defense against pen testing.
That reconnaissance or the actual scanning phase of our pen testing lifecycle
is being conducted. So when we go ahead and start configuring pinpoint scanned
and identifying specific plugins, because now I'm going to clear this out and
show you specifically.
And let me minimize this, and we'll try to do this at the same time because the
skills pretty quick. Go back into our pinpoint scan going to launch into
T or actually really start to watch our corporate so I can have been both going
at same time.
It's pretty close to each other.
And default.
We still get a lot of traffic, but it's not near as much as what we had when we
did a complete sweep of every possible plugin within the actual Nessus catalog.
So this helps us hide our tracks a little bit as we're trying to be as discreet
as possible as pen testers. We will be coming back to Nessus later on and I
will be bringing up some more examples of vulnerabilities that we get scan for
specifically,
especially when we start getting into some of the actual leveraging of those
vulnerabilities. But I wanted to be able to go through and show you that we can
tailor our scans to something that is desirable to what we need.
And there are cases to where we want to do a full sweep and some cases where we
want to be as discreet and as pinpoint as possible. I hope this has been
informative for you and I'd like to thank you for viewing.
[BLANK_AUDIO]