Nessus

Walkthrough of the Nessus room.

---

Task 1: Introduction

---

Task 2: Installation

All the task doesn’t require any answers.

---

Task 3: Navigation and Scans

Navigation and Scan Types!

What is the name of the button which is used to launch a scan?

Answers: New Scan

What side menu option allows us to create custom templates?

Answers: Policies

What menu allows us to change plugin properties such as hiding them or changing their severity?

Answers: Plugin Rules

In the ‘Scan Templates‘ section after clicking on ‘New Scan‘, what scan allows us to see simply what hosts are alive?

Answers: Host Discovery

One of the most useful scan types, which is considered to be ‘suitable for any host‘?

Answers: Basic Network Scan

What scan allows you to ‘Authenticate to hosts and enumerate missing updates‘?

Answers: Credentialed Patch Audit

What scan is specifically used for scanning Web Applications? 

Answers: Web Application Tests

---

Task 4: Scanning!

Run a Network Scan!

Create a new ‘Basic Network Scan‘ targeting the deployed VM. What option can we set under ‘BASIC‘ (on the left) to set a time for this scan to run? This can be very useful when network congestion is an issue.

Answer: Schedule

Under ‘DISCOVERY‘ (on the left) set the ‘Scan Type‘ to cover ports 1-65535. What is this type called?

Answer: Port scan (all ports)

What ‘Scan Type’ can we change to under ‘ADVANCED‘ for lower bandwidth connection?

Answer: Scan low bandwidth links

With these options set,  launch the scan. 

Answer: No answer required.

After the scan completes, which ‘Vulnerability‘ in the ‘Port scanners‘ family can we view the details of to see the open ports on this host?

Answer: Nessus SYN Scanner

What Apache HTTP Server Version is reported by Nessus?

Answer: 2.4.99

---

Task 5: Scanning a Web Application!

Run a Web Application scan on the VM!
(Running this Scan will take some time to complete, please be patiest)

What is the plugin id of the plugin that determines the HTTP server type and version?

Answer: 10107

What authentication page is discovered by the scanner that transmits credentials in cleartext?

Answer: login.php

What is the file extension of the config backup?

Answer: .bak

Which directory contains example documents? (This will be in a php directory)

Answer: /external/phpids/0.6/docs/examples/

What vulnerability is this application susceptible to that is associated with X-Frame-Options?

Answer: Clickjacking