So it's important to note that we have to review the results because there are
folks out there
that will run these scans and just say, "Bag
initially ran." And so on the right, under the status and report, you'll see a
one. That means that
that scan has only run once and the more times we run it, the more that count
goes up. So I'm
going to click on that one right there and you can see here that we have a very
brief synopsis of
what's going on and it gives us a breakdown of how many high-medium lows, logs,
and whatever was found.
Now, you may notice this is a little bit more in-depth than what Nessus gave us
as a result from the
original scans that we ran on there. That's primarily because we ran Nessus in
the free version
under our trial license and that OpenVos actually does a little bit more in the
community edition.
I'm not telling you which one to go with, but hint, hint, I use OpenVos more
than I do Nessus.
When you actually go in here as well too, it's a little bit more laid out than
Nessus is because
now we can just go on and click on the actual report and inside of there you
have your different
tabs. Now, the first one by default that we're at is information. We're going
to click on the next one
over and go into results of 17 of 42. Now, this here is going to give you a
list of every vulnerability
that it found on that wind 10B web system. One thing I want to note more than
anything else
and that is that when we ran the scan, we ran it unprudentialed. So, this was
an outside scan that
was going through as a regular random person on the internet attacking this or
scanning this system
for a potential attack. And as a pen tester, if we get that many results on the
actual scan itself,
take note, that's going to be one of our targets. Just want to stress that real
quick as we go back
and take a look at these results. So, you can actually see inside of here that
we have based
on severity by default. Now, if you go into the actual other tabs, you can see
like, for instance,
the host that IP address, it gives you a breakdown of the actual operating
system that was on there
using information that in map kind of uses to be able to OS Manger brand. We go
into ports and
see which ones were open primarily. And here we have to now this may differ
from your other scanning
results like Nessus or even in map. Just keep that in mind that, you know, more
than one
system in place allows you to verify and add to your results applications. We
get a breakdown of
the different applications that we can potentially see from the outside. And as
you go into the actual
courses that use the BWAP system, you'll understand why PHP 7.4.33 came up as
one of the applications.
Now, there are the ones in there as well too, which leads into the ID of that
OS that's on that
target system. But you can get more information if you go into the operating
system tab and it
will give you best guess that this is Microsoft Windows Server 2022 or blah
blah blah or Windows 10.
Now I can click on that even further and get more details to show you here. And
it goes further
into the weeds on that explanation of how it got to identify that OS. Now, and
again, we're just
briefly going through this because this is so similar to Nessus results thing.
This should be
very easy for us to be able to adapt into OpenBoss. Now, this is where OpenBoss
differs and I'm going
to go a little bit more detail because in the CBE's category tab, we actually
have a breakdown here
of all CVE's. Their severity based on CVSS scoring and the definition that was
used to be able to
identify that inside of the actual scan itself. So here under the CBE's, you
can see that we have
quite a few that popped up and they're based by default on severity. And a lot
of these are
coming up as very high. And that's okay because this is a test system within
our environment. And
as a pen tester, this is the one to attack. So as you go through here, you can
verify the CBE's
based on the resources skill that we did previously and correlate the
information to
vulnerability, method of attack, and likelihood of getting caught. And seeing
if there is an actual
fix to it as a security administrator to see if we can actually plug this in
and make sure that that
gets patched or find a way to be able to work around it if we can't because of
other system
requirements. Now there's another tab to the next that calls closed CVE's. And
these are all CVE's
that have been identified way back when that have already had their remediation
reported to the
different vulnerability assessment agencies out there. For instance, CVE, NIST,
all the other ones.
So, but these are still coming up as a vulnerability on the system. And as a
security administrator,
this tab right here should raise alarms and bells and flags and all this other
stuff,
because these are things that could have been caught right away, right? So,
something to keep in mind that when you see that, take note. We have TLS
certificates. If this was
involved inside of, let's say a certificate authority of some type, you would
see vulnerabilities or
information pop up here. Any error messages that the scan went through would
pop up in the error
messages tab. And if we added any tags on the scan itself, pretty
straightforward results.
And you could even go through and do this for all your different host. So, like
, if you run a range,
if you go to the host tab right here, as I pop out and zoom in for you, you can
see that we have
that one host right there, 0.13, you would see multiple hosts run through there
based on the
information you can put in for your targets. So, it's very straightforward and
allows us as
pen testers to be able to go through and identify potential vulnerabilities for
us to be able to
exploit. And by being able to bring all this together and correlate with NSSIS,
we can verify that the
vulnerability does in fact exist. And with OpenVos, let's say we're on a
tighter budget,
it allows us to be able to go through and have a more detailed vulnerability
assessment scanning
tool as our primary instead of having to fork over a lot of money inside of NSS
IS. Now, if your
organization uses NSSIS, I would still highly encourage you to be able to use
OpenVos as well,
or maybe whatever else that you would like to use out there. But trust me, in
Pen 200, there's
there's definitely a reason why we were teaching open boss here.