Now that we have the basics of our OpenVos vulnerability scanner set up,
we're going to start going in and taking a look at how to do some minor
configurations
and set up the scope for our scanning. So let's head on over. And as you can
see here,
I'm in Kali inside of our lab. Now I want to make a slight change and we're
going to walk
through this together so that way we can understand what's going on here. It's
okay if you want to
work with it inside of Kali using 127001. But inside of our lab environment,
this is kind of
compressed and compact and I want to be able to look at it from an external
browser. And the reason
this is is because it makes it a little bit easier on me and also ensures that
we have
remote access to our scanner in just a case where physically separated from
each other.
I miss my pieces of equipment, right? So we're going to open up our eternal
window here and we're
going to do a CTO GVM dash stop. Now what this is going to do is actually stop
the service of
OpenVos from running, put it in a shutdown state. So that way we can make some
changes in how we
start things up. And once this completes, and this may take a second, hopefully
not. Okay, there it
goes. We're going to do a pseudo GSAD dash listen equals 0.0 dot zero space
dash dash port equals 9392.
Now there's two things I want to point out here and I'm going to zoom in on
this for you. That is
listen equals 000 zero zero makes it to where it's more like a universal
addressing. So if you want
to use the IP address or let's say you have multiple adapters on the system
that have multiple IP
addresses, you'd be able to access them this way. And the port number is the
port number.
By default it's 9392 but if you want to change it to something that's more
adaptive to your network,
by all means go ahead and do so. We're going to go ahead and zoom out and press
enter
and you can see where the changes have been made. We're going to do a pseudo
system control edit
GSAD. Now inside of here what we're taking a look for is basically a exec start
line. And
there's a couple of different ways that you can do this but I happen to know
where it's at right
here. I have it highlighted right there. And we can basically just uncomment
this line.
Comment being that it's code in there with the pound sign in front of it,
making it to where it's more of a comment. So if you want to take notes or have
code in there
that you want to use at a later time, this is where we do it at. And so by
removing that
downside you see that the color of it changed allowing us to be able to have it
encode itself.
Now I'm not going to change anything about this line other than I'm going to go
change the actual
listen IP address to match what we just did in the actual terminal. So zero
does zero does zero
and that should be all I need to do. Now at this point I want you to hit
control
X and it's going to ask you if you want to save this and you're going to say
yes.
Right to file. Absolutely. So now it's going to think about it for a second and
commit its changes.
And then if you as long as you don't have anything with the firewall or
anything like that,
we just go ahead and go into pseudo GVM start. After swapping back over to my
browser inside
of Kali, you could see that in the address bar as I zoom in for you right here,
HTTPS 192.160.53,
which is the IP address of this particular Kali system in our lab with 9392 as
our port. I'm going
to go to advanced and accept the risk because it's doing it under a different
IP address now.
And you can see that we have our login screen here. Same login information,
same server, same
everything, but just now being able to address it with the actual IP address.
If you do get this
error right here, don't be afraid to just simply restart your system and have
everything start up
correctly. That forces the system services to be able to start and stop in a
controlled manner.
And that's exactly what we're going to be do here. So I will be right back
after restarting
and go ahead and open up our browser again. We go straight to the actual IP
address like we just
mentioned and it comes right back up. No problems whatsoever. So that should be
able to go to
Microsoft Edge. I know, I know. And you can see here that I have that IP
address pointed in as well
for the open Vos dashboard. And I'm doing this from the actual hyperb host,
meaning that I'm able
to remote into the actual page itself. Again, self science certificate, don't
be afraid.
If you have a CA within your domain or organization, you can actually make your
own certificates
or have one issue to you from a CA elsewhere. But same thing, GBM, GBM as our
username and
password. And this allows me as a side to make a full screen so we can see
things a whole lot easier.
Now, again, it took about an hour or so to be able to load all the definitions
up for the first time,
but this will not happen every single time. Future updates will not be near as
long.
But also, I do want to point out this as well, too. And that is we are
currently using the Greenbone
Community Feed, which is the free version of Open Vos and still has a lot of
capabilities and
that we had to pay for us to be able to use inside of Nessus. We're going to be
walking through,
doing a quick scan and setting you up for how to be able to accomplish this in
the future when
you want to run it and also get ourselves set up inside of a challenge coming
up at the end of the
skill. Now, the scans are pretty self explanatory. And I've actually completed
one here. So I'm not
going to give everything away just yet. I want to walk you through
understanding how this is done
first. When we go on the top left side and I'll zoom in for you here real quick
under dashboard,
you're going to expand the scan drop down and go into task. Now, it may seem
elbow to hand again,
but bear with me on this. You may also see a magic one next to the Word
document with the plus sign.
That plus sign word document is what we're going to be clicking on here in just
a second to do a
new task scan, right? So when I zoom out, you'll see that I have already
conducted one and we'll
look at the results of this momentarily because these scans do take a little
bit. But hovering
over that new Word document, you will see that there is new task or you could
say do container
tasks. We're just going to stick with new task first. Click on new task and you
can call this
whatever you like. And we'll just say second scan on this one and they add
comments as you so desire
and scan targets on this are going to be based on what you have in your
inventory or assets,
which we'll cover here momentarily. But you can just add one in here. You can
click on the far
right side where the other Word document is and say create new target and you
can manually input
the IP address of said target. And in this case, we're going to be attacking or
scanning the
Windows 10 system that's within our lab. Now this is already a target and
listed as the wind 10
be whap system. And again, we'll show that target here momentarily. But you can
also do a range. So
in this case, I can do 192.168.0.13 - 192.168.0 - 14. And you can even exclude
IPs to align with
the scope inside of your rules of engagement. Going down, you could say allow
simultaneous
scanning via multiple IPs. Yeah, you could do that. This goes into that stealth
iness that we'll
talk about here momentarily. And then you can also further decide what kind of
ports that you want
to be able to scan. Do you want to do all AA in a assigned TCP or do you want
to make it a mix of
TCP UDP or all TCP in map to top 100 UDP. And you can even further expand on
this by creating your
own port listing that you want to be able to scan for. Now the alive test is
also very verbose.
Yes. That allows us to be able to determine how we want to be able to check C
if the system's
live. The reason this is important is because not everything responds to a pain
. And that's the
ICMP function. Now scan config default is going to be ICMP. So you really, you
could select that
or ICMP if you want to be able to do that. Or you could browse through the rest
and determine how
you want to be able to touch that system to see if it's actually on. Because a
system, and we've
seen this in previous skills, can be on, have ICMP disabled and we can query
port 80 for instance.
And see if it's actually online. And it is. So feel free to look through there.
And then at the bottom
are the credentials for the authenticated checks. And this should be very
familiar
because we covered this in Nessus. Now we're going to be skipping that because
some of this is
old hat and we've already covered all of this in Nessus. We're just looking at
it in a different
format here. And on the bottom, do you want to do reverse lookup or reverse
lookup only. That's
up to you if you want to be able to do that. I leave it at no because it goes
and queries the
whole system as I as a whole. And the same thing with reverse lookup unified.
Now you simply just
save this right. Oh, there was one, one more thing target already exist. So I
got to rename this for
a second. I'm going to call this one a second. Target because I forgot to name
the wind 10 b
WAP system target correctly. So I'm going to go ahead and save. And then you're
going to be at
the new task that you originally wanted to go to in the first place. Second
scan because we went
back to it by adding the targets in. And now you can go and look at your
schedule. And I'm going to
show you this real quick. You can schedule it out how you see fit or you could
just click on one run
run once and run it whenever you feel. So I'm going to click on run once and
then
leave everything else default in there and save. And right there you'll see
where the second scan
has just popped up. And all this will be inside of the open boss when you get
inside the lab.
So you could see that that scan is there and then on the right side you see
where we have the play
button. And just like in Nessus you hit the play and the scan goes. Now these
scans take a minute.
And here in a second I'll show you the results of the wind 10 b WAP scan.