Scanning with Nessus from Within Metasploit !

First of all, destroy the existing database with the db_destroy command
and create a new one using db_connect .

Load the Nessus plug-in by running load nessus, as shown here:


msf > db_destroy postgres:toor@127.0.0.1/msf3
[*] Warning: You will need to enter the password at the prompts below
Password:
msf > db_connect postgres:toor@127.0.0.1/msf3
msf > load nessus
[*] Nessus Bridge for Metasploit 1.1
[+] Type nessus_help for a command listing
[+] Exploit Index - (/root/.msf3/nessus_index) - is valid.
[*] Successfully loaded plugin: Nessus



Before starting a scan with the Bridge, you first need to authenticate
to your Nessus server using nessus_connect, as shown here:

msf > nessus_connect Rohit:password@192.168.1.101:8834 ok
[*] Connecting to https://192.168.1.101:8834/ as Rohit
[*] Authenticated

As you need to initiate a scan using a defined policy by its policy ID
number. To list the available scan policies
on the server, use nessus_policy_list:

msf > nessus_policy_list

Take note of the policy ID you want to use for your scan, and then
launch a new scan with nessus_scan_new followed by the policy number,
a name for your scan, and your target IP address as shown next:


msf > nessus_scan_new
[*] Usage:
[*] nessus_scan_new <policy id> <scan name> <targets>

[*] use nessus_policy_list to list all available policies

msf > nessus_scan_new 2 bridge_scan 192.168.1.2


While your scan is in progress, you can see its status by running the
nessus_scan_status command. When this command’s output responds
with “No Scans Running ”, you will know that your scan
has completed.

After the scan has completed, you can list the available scan reports
with the nessus_report_list command:


msf > nessus_report_list
msf > nessus_report_get ID

Vulnerability Scanning with Nessus !

Nessus is a well known and popular vulnerability scanner that is free
for personal, non-commercial use that was first released in 1998 by
Renaurd Deraison and currently published by Tenable Network Security.

Nessus Configuration :

After you have downloaded and installed Nessus, open your web browser
and navigate to https://<youripaddress>:8834

Creating a Nessus Scan Policy :

Before beginning a scan, you first need to create a Nessus scan policy.
On the Policies tab, click the green Add button to open the policy
configuration window.

Running a Nessus Scan :
After you have created a scan policy, you are ready to configure a scan.
Begin by selecting the Scans tab, and then click the Add button to
open the scan configuration window.


Nessus Reports :
After the scan is complete, it will no longer appear under Scans, and
you should find a new entry under the Reports tab listing the name of
the scan.

Importing Results into the Metasploit Framework :

Now let’s import our results into the Framework.
Click the Download Report button on the Reports tab to save the results
to your hard drive.

Load msfconsole, create a new database with db_connect, and import the
Nessus results file by entering db_import followed by the report
filename.

msf > db_connect postgres:toor@127.0.0.1/msf3
msf > db_import /tmp/nessus_report_Host_195.nessus
[*] Importing 'Nessus XML (v2)' data
[*] Importing host 192.168.1.195
For a complete listing of the vulnerability data that was imported into
Metasploit, enter db_vulns without any switches.

How to run NeXpose within MSFconsole !

Running NeXpose from the web GUI is great for fine-tuning vulnerability
scans and generating reports.

But if you prefer to remain in msfconsole, you can still run full
vulnerability scans with the NeXpose plug-in included in Metasploit.

First of all, delete any existing database with db_destroy, create a
new database in Metasploit with db_connect, and then load the NeXpose
plug-in with load nexpose :




msf > db_destroy postgres:toor@127.0.0.1/msf3
[*] Warning: You will need to enter the password at the prompts below
Password:
msf > db_connect postgres:toor@127.0.0.1/msf3
msf > load nexpose
[*] NeXpose integration has been activated
[*] Successfully loaded plugin: nexpose



Before running your first scan from msfconsole, you will need to
connect to your NeXpose installation. Enter nexpose_connect -h to
display the usage required to connect; add your username, password, and
host address; and accept the SSL certificate warning by adding ok to
the end of the connect string:



msf > nexpose_connect -h
[*] Usage:
[*] nexpose_connect username:password@host[:port] <ssl-confirm>
[*] -OR-
[*] nexpose_connect username password host port <ssl-confirm>
msf > nexpose_connect user:password@192.168.1.2 ok
[*] Connecting to NeXpose instance at 192.168.1.2:3780 with username user...




Now enter nexpose_scan followed by the target IP address to initiate a
scan:



msf > nexpose_scan 192.168.1.2
[*] Scanning 1 addresses with template pentest-audit in sets of 32
[*] Completed the scan of 1 addresses
msf >


After the NeXpose scan completes, the database you created earlier
should contain the results of the vulnerability scan. To view the
results, enter db_hosts,

msf > db_hosts -c address
Hosts
=====
address         Svcs    Vulns   Workspace
-------         ----   -----    ---------
192.168.1.2        5     8     default
msf >
As you can see, NeXpose has discovered seven vulnerabilities.
Run db_vulns to display the vulnerabilities found:

msf > db_vulns

Vulnerability Scanning with NeXpose !

 NeXpose is Rapid7’s vulnerability scanner that scans networks to
identify the devices running on them and performs checks to identify
security weaknesses in operating systems and applications.

We will first perform a basic overt scan of our
target and import the vulnerability scan results into Metasploit. We
will close out this section by showing you how to run a NeXpose
vulnerability scan directly from msfconsole rather than using the
web-based GUI.

Configuration:

After installing NeXpose Community, open a web browser and navigate to

https://<youripaddress>:3780

On the NeXpose main page, you will notice a number of tabs at the top
of the interface like Assets tab,Reports tab,Vulnerabilities tab,
Administration tab.

The New Site Wizard :
Prior to running a vulnerability scan with NeXpose, you need to
configure a site. This sites will then be scanned by
NeXpose, and different scan types can be defined for a particular site.

To create a site, click the New Site button on the NeXpose home page,
enter a name for your site and a brief description, and then
click Next.

In the devices step, you have quite a bit of granularity
in defining your targets. You can add a single IP address, address
ranges, hostnames, and more. Click Next when you have finished adding
and excluding devices.

At the scan setup step, you can choose from several different scan templates,
such as Discovery Scan and Penetration test; select the scanning
engine you want to use. click Next to continue.

Add credentials for the site you want to scan, if you have them.
On the Credentials tab, click the New Login button, type a username
and password for the IP address you want to scan, and then click Test
Login to verify your credentials then save them.

The New Report Wizard :

Click New Report, Enter a friendly name, and then in the Report format
field, select NeXpose Simple XML Export so that you will be able to
import the scan results into Metasploit.

Click Next when you are ready to proceed.
In the subsequent window, add the devices you want to be included in
the report by clicking Select Sites to add your scanned target range,
Then click Save.
In the Select Devices dialog, select the targets to include in your
report and then click Save.
Back in the Report Configuration wizard, click Save to accept the
remaining defaults for the report.

Importing Your Report into the Metasploit Framework:

Having completed a full vulnerability scan with NeXpose, you need to
import the results into Metasploit. But before you do, you must create
a new database from msfconsole by issuing db_connect. After creating
that database you’ll import the NeXpose XML using the db_import command.

--------------------
msf > db_connect postgres:toor@127.0.0.1/msf3
msf > db_import /tmp/report.xml
[*] Importing 'NeXpose Simple XML' data
[*] Importing host 192.168.1.195
[*] Successfully imported /tmp/report.xml
msf > db_hosts -c address,svcs,vulns
---------------------------

Vulnerability scanning : with Metasploit!

Scanning is one of the most important steps in the penetration testing
process; if done thoroughly, it will provide the best value to your
client.

A vulnerability scanner is an automated program designed to look for
weaknesses in computers, computer systems, networks, and applications.
A vulnerability scanner can also use a given set of user credentials to
log into the remote system and enumerate the software and services to
determine whether they are patched.

The Basic Vulnerability Scan :
we use netcat to grab a banner from the target 192.168.1.2. Banner
grabbing is the act of connecting to a remote network service and
reading the service identification (banner) that is returned.

root@kali:/opt/framework3/msf3# nc 192.168.1.2 80
GET HTTP 1/1
HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/5.1

As you can see, The information returned tells us that the system
running on port 80 is a Microsoft IIS 5.1–based web server. Armed with
this information, we could use a vulnerability scanner to determine
whether this version of IIS has any vulnerabilities associated with it
and whether this particular server has been patched.

SMB Login Check :
A common situation to find yourself in is being in possession of a
valid username and password combination, and wondering where else you
can use it. This is where the SMB Login Check Scanner can be very
useful, as it will connect to a range of hosts and determine if the
username/password combination can access the target.

-----------------------
msf > use auxiliary/scanner/smb/smb_login
msf auxiliary(smb_login) > show options
      ---show options------

msf auxiliary(smb_login) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(smb_login) > set SMBUser user
SMBUser => user
msf auxiliary(smb_login) > set SMBPass pasword
SMBPass => pasword
msf auxiliary(smb_login) > set THREADS 50
THREADS => 50
msf auxiliary(smb_login) > run
--------------------------------------------

VNC Authentication :

The VNC Authentication None Scanner will search a range of IP addresses
looking for targets that are running a VNC server without a password
configured.

To utilize the VNC scanner, we first select the auxiliary module,
define our options, then let it run.
----------------------------------
msf auxiliary(vnc_none_auth) > use auxiliary/scanner/vnc/vnc_none_auth
msf auxiliary(vnc_none_auth) > show options

Module options:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    5900             yes       The target port
   THREADS  1                yes       The number of concurrent threads

msf auxiliary(vnc_none_auth) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(vnc_none_auth) > set THREADS 50
THREADS => 50
msf auxiliary(vnc_none_auth) > run

Searching for vulnerability and Penetrating in system !

In my previous tutorial, i was explaining about port scanning, version

detection and which service is running on the target system.

Before we proceed let me clear one thing,  To protect yourself against

a hacker, you have to think like a hacker. So which is  i am going to share

with you, this is for educational purpose only!

Now once the hacker has the name of the software being used and its

version number, he would take that information and search a couple

vulnerability databases for an exploit.

If there’s an exploit available, he will run it against the server and

take complete control. If there isn’t any, he would move onto another

open port and try again on a different service.

But when there is no exploit available for specific port, then

Most hacker would move on to another port to try and find another

possible vulnerability, but this doesn’t mean every hacker will.

But Remember A skillful hacker is determined, he may try to locate a

vulnerability in the current software version and develop an exploit

for it.

Ohk now let me tell some helpful resources in finding vulnerabilities

and exploits :

1. Searching to SecurityFocus( for Vulnerabilities) :

SecurityFocus database has some handy tools for searching for

vulnerabilities. It will allow us to search by vendor, by title of the

software and by the version. Finally, it will allow us to search by CVE,

which is the Common Vulnerability and Exploit number.

2. Finding Exploits :

Once we've found a vulnerability that virtually every PC will have, the

next step is to find an exploit.

Developing an exploit requires some advanced coding skills, but is not

beyond the capability of a talented, aspiring hacker.

To find the exploit for any specific vulnerability, you can use

www.exploit-db.com

You can say it is the king of exploit database ;-)

Or you can use

http://1337day.com/

Now after finding the right exploit,  it's time to Penetrating.

The more exploits you run, the more you will notice that half of them

may not work.

That is main reason why programming knowledge is needed, so you

could edit the exploit script to work for you.

Once a skilled hacker gains root to a server he has the ability to do a

lot of damage.

Note : This is for educational purpose only!

Scanning : The first phases of hacking !

Scanning is the first phases of hacking and involve the hacker locating

target systems or networks.

During scanning, the hacker continues to gather information regarding

the network and its individual host systems. Data such as IP addresses,

operating system, services, and installed applications can help the

hacker decide which type of exploit to use in hacking a system.

Basically Scanning is the process of locating systems that are alive

and responding on the network. Ethical hackers use it to identify

target systems’ IP addresses.

If i say in simple words, There are basically three types of scanning :

Port scanning                   Determines open ports and services

Network scanning           IP addresses

Vulnerability scanning     Presence of known weaknesses

In this tutorial, we will discuss about port scanning!

Port scanning :

The aim of port scanning a server is to detect its open ports the

port’s listening services. Once a hacker knows all the services

running on target server, he could search for possible vulnerabilities

they may have and exploit them to take control of your website or system

Before we proceed, let me clear what is CEH Scanning Methodology.

CEH scanning methodology :

:=>   Check for Live Systems
:=>   Check for Open Ports
:=>   Service Identification
:=>   Banner Grabbing /OS Fingerprinting
:=>   Vulnerability Scanning
:=>   Draw Network Diagrams of
:=>   Vulnerable Hosts
:=>   Prepare Proxies
:=>   Attack

Nmap is a free open source tool that quickly and efficiently performs

ping sweeps, port scanning, service identification, IP address

detection, and operating system detection.

(You can download it from here.)

Nmap support several types of scans like :

* TCP connect
* XMAS tree scan
* SYN stealth scan
* Null scan
* Windows scan
* ACK scan

If you want to scan a single system, then you can use a simple command:

nmap 127.0.1.1

If you want to scan the entire subnet, then the command is

nmap 127.0.1.1/24

Now i will explain each scan type :

1. TCP connect or Simple scan :

# TCP connect() Scan [-sT]

This the default scanning technique used.

Keep in mind that this technique is only applicable to find out the

TCP ports, not the UDP ports.

nmap -sT 127.0.1.1

# SYN Stealth Scan [-sS]

It is a basic scan, and it is also called half-open scanning because

this technique allows Nmap to get information from the remote host

without the complete TCP handshake process.

nmap -sS 127.0.1.1

2. FIN, Null and Xmas Tree Scans [-sF, -sN, -sX] :

Sometimes a normal TCP SYN scan is not the best solution because of the

firewall. This is where FIN action comes in action !

The FIN scan sends a packet with only the FIN flag set, the Xmas Tree

scan sets the FIN, URG and PUSH flags and the Null scan sends a packet

with no flags switched on.

These scan types will work against any system where the TCP/IP

implementation follows RFC 793. Microsoft Windows does not follow the

RFC, and will ignore these packets even on closed ports. This

technicality allows you to detect an MS Windows system by running SYN

along with one of these scans. If the SYN scan shows open ports, and

the FIN/NUL/XMAS does not, chances are you’re looking at a Windows box

(though OS Fingerprinting is a much more reliable way of determining

the OS running on a target!)

nmap -sF 127.0.1.1

3. Ping Scan [-sP]

It allows you to detect which computers are online,

rather than which ports are open.

nmap -sP 127.0.1.1

4. UDP Scan [-sU]

5.  IP Protocol Scans [-sO]

6. Idle Scanning [-sI] :

it is an advance scan that provides complete anonymity while scanning.

7. Version Detection (-sV) :

Version detection is the technique that is used to find out what

software version is running on the target computer and on the

respective ports.

This information can be critical in determining an entry point for an

attack.

nmap -sV 127.0.1.1

8. OS Fingerprinting :

One of the most important feature that Nmap has is the ability to

detect remote operating systems and software. It is very helpful

during a penetration test to know about the operating system and the

software used by the remote computer because you can easily predict

the known vulnerabilities from this information.

nmap -O 127.0.1.1

Nmap OS fingerprinting technique discovers the:

    Device type (router, work station, and so on)
    Running (running operating system)
    OS details (the name and the version of OS)
    Network distance (the distance in hops between the target and 
    attacker)

9. Typical Scanning Session :

# We can scan our target using a SYN scan [-sS] and -A to enable OS

fingerprinting and version detection.

nmap -sS -A 127.0.1.1

Now we’ll move on to nmap  

-sS -P0 -A -v 127.0.1.1

we can deduce that target is a Linux system running a 2.4 to 2.6 kernel

with open ports 21/tcp, 22/tcp, 631/tcp and 6000/tcp(Assume).