About this book

IT security is a vast and exciting domain, with vulnerability assessment and penetration testing being the most important and commonly performed security activities across organizations today. The Nessus tool gives the end user the ability to perform these kinds of security tests quickly and effectively.

Nessus is a widely used tool for vulnerability assessment, and Learning Nessus for Penetration Testing gives you a comprehensive insight into the use of this tool. This book is a step-by-step guide that will teach you about the various options available in the Nessus vulnerability scanner tool so you can conduct a vulnerability assessment that helps to identify exposures in IT infrastructure quickly and efficiently. This book will also give you an insight into penetration testing and how to conduct compliance checks using Nessus.

This book starts off with an introduction to vulnerability assessment and penetration testing before moving on to show you the steps needed to install Nessus on Windows and Linux platforms.

Throughout the course of this book, you will learn about the various administrative options available in Nessus such as how to create a new user. You will also learn about important concepts like how to analyze results to remove false positives and criticality. At the end of this book, you will also be introduced to the compliance check feature of Nessus and given an insight into how it is different from regular vulnerability scanning.

Learning Nessus for Penetration Testing teaches you everything you need to know about how to perform VA/PT effectively using Nessus to secure your IT infrastructure and to meet compliance requirements in an effective and efficient manner.

Publication date:
January 2014
Publisher
Packt
Pages
116
ISBN
9781783550999

 

Chapter 1. Fundamentals

These days, security is the most vital subject for any organization irrespective of their size or the kind of the business they do. The primary reason for this is that organizations don't want to lose their reputation or business over compromises affecting security; secondly, they have to meet legal and regulatory requirements. When it comes to technical security of the infrastructure, Vulnerability Assessment and Penetration Testing (PT or PenTest) play the most vital role. This chapter illustrates what a PT or PenTest is, why it is required and how to set up and manage Nessus for your organization.

This chapter will introduce you to Nessus, a tool for vulnerability assessment and penetration testing. We will also cover the following topics:

  • Vulnerability Assessment

  • Penetration testing

  • Introduction to Nessus

  • Installing Nessus on different platforms

  • Updating Nessus plugins

  • Nessus user management

  • Nessus system configuration

 

Vulnerability Assessment and Penetration Testing


Vulnerability Assessment (VA) and Penetrating Testing (PT or PenTest) are the most common types of technical security risk assessments or technical audits conducted using different tools. These tools provide best outcomes if they are used optimally. An improper configuration may lead to multiple false positives that may or may not reflect true vulnerabilities. Vulnerability assessment tools are widely used by all, from small organizations to large enterprises, to assess their security status. This helps them with making timely decisions to protect themselves from these vulnerabilities. This book outlines the steps involved in conducting Vulnerability Assessments and PenTests using Nessus. Nessus is a widely recognized tool for such purposes. This section introduces you to basic terminology with reference to these two types of assessments.

Vulnerability in terms of IT systems can be defined as potential weaknesses in system/infrastructure that, if exploited, can result in the realization of an attack on the system.

An example of a vulnerability is a weak, dictionary-word password in a system that can be exploited by a brute force attack (dictionary attack) attempting to guess the password. This may result in the password being compromised and an unauthorized person gaining access to the system.

Note

The word system in this book refers to any asset existing in an information technology or non-information technology environment.

Vulnerability Assessment is a phase-wise approach to identifying the vulnerabilities existing in an infrastructure. This can be done using automated scanning tools such as Nessus, which uses its set of plugins corresponding to different types of known security loopholes in infrastructure, or a manual checklist-based approach that uses best practices and published vulnerabilities on well-known vulnerability tracking sites. The manual approach is not as comprehensive as a tool-based approach and will be more time-consuming. The kind of checks that are performed by a vulnerability assessment tool can also be done manually, but this will take a lot more time than an automated tool.

Penetration Testing has an additional step for vulnerability assessment, exploiting the vulnerabilities. Penetration Testing is an intrusive test, where the personnel doing the penetration test will first do a vulnerability assessment to identify the vulnerabilities, and as a next step, will try to penetrate the system by exploiting the identified vulnerabilities.

Need for Vulnerability Assessment

It is very important for you to understand why Vulnerability Assessment or Penetration Testing is required. Though there are multiple direct or indirect benefits for conducting a vulnerability assessment or a PenTest, a few of them have been recorded here for your understanding.

Risk prevention

Vulnerability Assessment uncovers the loopholes/gaps/vulnerabilities in the system. By running these scans on a periodic basis, an organization can identify known vulnerabilities in the IT infrastructure in time. Vulnerability Assessment reduces the likelihood of noncompliance to the different compliance and regulatory requirements since you know your vulnerabilities already. Awareness of such vulnerabilities in time can help an organization to fix them and mitigate the risks involved in advance before they get exploited. The risks of getting a vulnerability exploited include:

  • Financial loss due to vulnerability exploits

  • Organization reputation

  • Data theft

  • Confidentiality compromise

  • Integrity compromise

  • Availability compromise

Compliance requirements

The well-known information security standards (for example, ISO 27001, PCI DSS, and PA DSS) have control requirements that mandate that a Vulnerability Assessment must be performed.

A few countries have specific regulatory requirements for conducting Vulnerability Assessments in some specific industry sectors such as banking and telecom.

The life cycles of Vulnerability Assessment and Penetration Testing

This section describes the key phases in the life cycles of VA and PenTest. These life cycles are almost identical; Penetration Testing involves the additional step of exploiting the identified vulnerabilities.

It is recommended that you perform testing based on the requirements and business objectives of testing in an organization, be it Vulnerability Assessment or Penetration Testing. The following stages are involved in this life cycle:

  1. Scoping

  2. Information gathering

  3. Vulnerability scanning

  4. False positive analysis

  5. Vulnerability exploitation (Penetration Testing)

  6. Report generation

The following figure illustrates the different sequential stages recommended to follow for a Vulnerability Assessment or Penetration Testing:

Stage 1 – scoping

Scoping is the primary step of any security assessment activity. In order to execute a VA or PenTest, the first step is to identify the scope of the assessment in terms of infrastructure against which the assessment is to be conducted, for example, servers, network devices, security devices, databases, and applications. Scoping depends on the business objective of the Vulnerability Assessment. During the scoping, a scanning window should also be agreed upon. Also, the types of attacks that are permitted should be agreed upon. After deciding on the scope of assessment, this phase also includes planning and preparation for the test, which includes deciding on the team, date, and time of the test. Another major factor that should be taken care of prior to beginning the engagement is signing a formal engagement agreement between the security tester and the party on whose infrastructure these tests will be performed. Scoping should also include identifying the count of infrastructure elements to be tested.

Apart from the infrastructure scope and other program management modalities, the exact scope, the organization's approach to the business objective, and the methodology of the assessment should be decided. For deciding on the business objective, the organization should identify the type of attack that it would like to get mimicked.

An example of an objective that a company might seek is: "To find out what an external attacker can achieve by targeting externally exposed infrastructure with only the knowledge of a publicaly exposed IP address." This type of requirement will be met through an external Blackbox penetration testing of infrastructure and applications, and the approach and the methodology should be in accordance with that.

Based on the accessibility of infrastructure from the Internet or intranet, the testing can be done from an external or internal network. Also, based on the type of details, the infrastructure testing can be Blackbox or Greybox. And depending on the type of infrastructure, the plugins or features of a vulnerability scanning tool should be enabled, aided by appropriate manual checks.

Note

In Blackbox testing, only details such as the IP address are shared with the tester. Details giving an insight to the infrastructure, such as type and OS version, are not shared with respect to Nessus Scanner; this type of testing will involve a non credential scan (explained in Chapter 2, Scanning). This allows the tester to mimic an external attacker with limited knowledge about the infrastructure.

Greybox testing will include some details of the infrastructure to be shared, such as the type of device and software version that allow getting more comprehensive and administrator credentials fed to the tool for more comprehensive results. In addition, to mimic an internal attacker with knowledge about the infrastructure with respect to Nessus Scanner, this type of testing will involve credentialed scanning, giving more comprehensive results.

Stage 2 – information gathering

Information gathering is the second and most important stage of a VA-PT assessment. This stage includes finding out information about the target system using both technical (WhoIS) and nontechnical passive methods such as the search engine and Internet groups). This step is critical as it helps in getting a better picture of the target infrastructure and its resources. As the timeline of the assessment is generally time bound, information captured during this phase helps in streamlining the effort of testing in the right direction by using the right tools and approach applicable to target systems. This step becomes more important for a Blackbox assessment where very limited information about the target system is shared.

Information gathering is followed by a more technical approach to map the target network using utilities such as pings and Telnet and using port scanners such as NMAP. The use of such tools would enable assessors to find a live host, open services, operating systems, and other information.

The information gathered through network mapping will further validate information gathered through other passive means about the target infrastructure, which is important to configure the vulnerability scanning tool. This ensures that scanning is done more appropriately.

Stage 3 – vulnerability scanning

This stage involves the actual scanning of the target infrastructure to identify existing vulnerabilities of the system. This is done using vulnerability scanners such as Nessus. Prior to scanning, the tool should be configured optimally as per the target infrastructure information captured during the initial phases. Care should also be taken that the tool is able to reach the target infrastructure by allowing access through relevant intermediate systems such as firewalls. Such scanners perform protocol TCP, UDP, and ICMP scans to find open ports and services running on the target machine and match them to well-known published vulnerabilities updated regularly in the tool's signature database if they exist in the target infrastructure. The output of this phase gives an overall view of what kind of vulnerabilities exist in the target infrastructure that if exploited can lead to system compromise.

Stage 4 – false positive analysis

As an output of the scanning phase, one would obtain a list of vulnerabilities of the target infrastructure. One of the key activities to be performed with the output would be false positive analysis, that is, removing any vulnerability that is falsely reported by the tool and does not exist in reality. All scanning tools are prone to report false positives, and this analysis can be done using methods such as correlating vulnerabilities with each other and previously gathered information and scan reports, along with actually checking whether system access is available.

Vulnerability scanners give their own risk rating to the identified vulnerabilities; these can be revisited considering the actual criticality of the infrastructure element (server or network device) to the network and impact of the vulnerability.

Stage 5 – vulnerability exploitation (Penetration Testing)

In case system owners require proof of existing vulnerabilities or exploits to understand the extent to which an attacker can compromise a vulnerable system, testers will be required to demonstrate exploits in a controlled environment with out actually making the infrastructure unavailable, unless that's a requirement. Penetration Testing is the next step to Vulnerability Assessment aiming to penetrate the target system based on exploits available for the identified vulnerabilities. For exploitation, our own knowledge or publicaly available exploits of well-known vulnerabilities can be utilized. Penetration Testing or Vulnerability Exploitation can be broadly divided into phases such as preexploitation, exploitation, and postexploitation.

Activities in the pre-exploitation phase are explained in phases 1 to 4, that is, enumerating the infrastructure and identifying the vulnerability.

Once any vulnerability is exploited to gain access to the system, the attacker should aim to further detail the network by sniffing traffic, mapping the internal network, and trying to obtain a higher privilege account to gain the maximum level of access to the system. This will enable testers to launch further attacks on the network to further increase the scope of compromised systems. The postexploitation step will also involve clearing of tracks by conducting activities such as clearing logs and disabling antivirus.

As a post-exploitation phase tester, you can demonstrate how an attacker can maintain access to the system through backdoors and rootkits.

Stage 6 – report generation

After completing the assessment as per the scope of work, final reporting needs to be done covering the following key areas:

  • A brief introduction about the assessment

  • The scope of assessment

  • The management/executive summary

  • A synopsis of findings with risk severity

  • Details about each finding with their impact and your recommendations to fix the vulnerability

 

Introduction to Nessus


Nessus is one of the most widely-used Vulnerability Assessment products. First released in the year 1998 by Renaud Deraison, this tool has been one of the most popular vulnerability scanning tools used across the industry for the past 15 years.

The official website of Nessus (http://www.tenable.com) describes it as follows:

"Nessus® is the industry's most widely-deployed vulnerability and configuration assessment product. Nessus features high-speed discovery, configuration auditing, asset profiling, sensitive data discovery, patch management integration, and vulnerability analysis of your security posture. Fueled by Nessus ProfessionalFeed®, a continuously-updated library with more than 50,000 individual vulnerability and configuration checks, and supported by an expert vulnerability research team, Nessus delivers accuracy to the marketplace. Nessus scales to serve the largest organizations and is quick-and-easy to deploy."

Over the years, Nessus has evolved from a pure play vulnerability scanner to include added assessment and auditing features such as configuration auditing, compliance auditing, patch auditing, control system auditing, and mobile device auditing. It is best known for the ease and flexibility offered by its Vulnerability Assessment feature.

The key infrastructure that is covered under Nessus Vulnerability Scanner includes the following:

  • Network devices: These include Juniper, Cisco, firewalls, and printers

  • Virtual hosts: These include VMware ESX, ESXi, vSphere, and vCenter

  • Operating systems: These include Windows, Mac, Linux, Solaris, BSD, Cisco iOS, and IBM iSeries

  • Databases: These include Oracle, MS SQL Server, MySQL, DB2, Informix/DRDA, and PostgreSQL

  • Web applications: These include web servers, web services, and OWASP vulnerabilities

Nessus Vulnerability Scanner is an easy-to-use tool. Someone new to the tool can learn it easily.

Initial Nessus setup

The detailed steps on how to install Nessus have been given later in this chapter. Once you install Nessus, you can do one-time setups for your Nessus scanner such as setting up user accounts to access the scanner; general settings, such as configuring SMTP or a web proxy, feed settings, mobile settings, and result settings; and configuring advanced configuration settings. These settings have been detailed later in this chapter. They are very unique to your scanning environment, which depends on your organization's security policies and preferences. You may also want to create some generic policies before you go for the scan, depending on the requirements.

Scheduling scans

Nessus provides the flexibility to schedule scans on target hosts for future scanning. This is as good as job scheduling. You can configure and schedule in advance with a predefined time and policy. Nessus will automatically initiate the scan at the defined time and e-mail the results to predefined e-mail IDs. This doesn't need any manual trigger to invoke scans. You can also schedule repeat scans such as "my scan target IPs should be scanned every Thursday at 3 AM CET". Most of the time, large enterprise organizations face a lot of challenges to identifying a scanning window. A scanning window is a time frame for the scan that defines at what time the scan should take place and the time by when the scan should be completed. Usually, the scanning window is decided based on the production load on the scanning machines. It is recommended that production machines be scanned only in nonpeak hours. Nonpeak hours is the time when the target or scanning machine is least used during a day/week.

The Nessus plugin

To enable a comprehensive coverage of security checks, Nessus provides a large variety of plugins grouped together to provide similar security checks. Grouping allows disabling or enabling a large quantity of plugins based on target machines in one go. Examples of the major plugin family include Windows, Linux, Solaris, Cisco, and Database. For details about plugins and the difference between the home feed and professional feed families, please refer to the Nessus official website at https://plugins.nessus.org.

Nessus, being one of the most widely-used tools, has an active online support community at https://discussions.nessus.org.

Nessus is one of the most cost-efficient scanning tools available with features such as low total cost of ownership (TCO) and scan unlimited number of IPs. Nessus subscriptions include software updates, access to Tenable's compliance and audit files, and support. Additionally, it also includes the daily update of vulnerability and configuration checks with automated installation.

Note

Apart from introducing Nessus, this chapter describes the basics of Vulnerability Assessment and Penetration Testing, two of the most common types of technical risk assessment conducted using Nessus. Along with this, various installation options in Nessus are also described.

Patch management using Nessus

Nessus is very successful in patch management; this is achieved by integrating Nessus with a variety of patch management solutions. The good part here is that you need not supply credentials to Nessus for scanning the target machines; instead, you need to supply the credentials for the patch management system. This is because the patch management system will already have the credentials to reach the target host.

Governance, risk, and compliance checks using Nessus

Nessus provides outputs in different formats, such as HTML, CSV, and PDF. This makes it much more flexible to feed the output to different tools to integrate with. These tools can be governance, risk, and compliance tools such as EMC RSA Archer SmartSuit or any other similar tool.

 

Installing Nessus on different platforms


Nessus supports almost all the popular operating systems. Depending on the availability of the operating system, the required installation steps given in this section can be followed to install Nessus. The latest information/steps can also be fetched from Nessus's official website. At the time of writing this book, Nessus supports the following operating system platforms:

  • Microsoft Windows – XP, 2003, 2008, Vista, 2012, 7, and 8

  • Linux – Debian, Red Hat, Fedora, SuSE, Ubuntu

  • Solaris

  • Mac

  • Free BSD

  • Checksums and GCP keys

The latest details about the preceding list can be obtained from Tenable Nessus's official website at http://www.tenable.com/.

Prerequisites

The scanning machine should have 4 GB of memory (preferably). However, refer to Nessus's official website http://www.tenable.com/ for the latest requirements.

A better processor will support facilitating a fast scan. The scanning machine should be selected by keeping the scope of the Nessus scan in view; if you plan to do a vulnerability assessment for a big enterprise, it is recommended that a high-end server machine be used.

Note

No firewall should block the traffic generated by Nessus to reach scanning target systems. If a firewall is in place, a firewall rule should be configured to allow all the traffic generated by the Nessus machine to reach scanning targets. Please don't forget to deactivate this firewall rule once the scan activity is completed.

If you reach out to scanning machines using a web proxy, proxy authentication credentials should be keyed in Nessus. This is an optional setting depending on your scanning environment.

You should have administrative rights on the machine to install Nessus, and the Nessus plugin feed activation code is required to update plugins.

Installing Nessus on Windows 7

For the latest Nessus package, either to buy or to evaluate, you should browse through to Tenable Nessus's official website at http://www.tenable.com/:

  1. Log in to the Nessus website to buy and download the latest Nessus software from the Products section.

    The Nessus software package should be downloaded according to the operating system you want to install Nessus for. The steps given on Nessus's website should be followed for downloading the Nessus package.

    It is important to note that Nessus should be downloaded as per the scanning machine operating system from which you plan to scan other systems, not by the operating systems which you are going to scan. For example, if you need to scan 10 Linux machines, one Solaris machine, and five Windows machines from a Windows 2008 server machine, download the Nessus package for the Windows 2008 operating system. Depending on the bit count of the operation system, you may choose a 32-bit/64-bit package.

  2. Once you have downloaded the Nessus executable file (the Nessus setup package), double-click on it to begin the installation. In case you don't have administrative privileges, press Shift and right-click on the executable file; click on Run as to run the installer with an administrative account.

  3. You might receive a security warning Do you want to run this file?. Click on the Run button.

  4. After clicking on Run, the installer will pop up a window to proceed with the installation.

  5. Click on Next, and this will pop up the window with the Nessus license agreement. It is very important for everyone to read through the license agreement and abide by the same.

  6. To proceed further with the Nessus installation, you need to accept the license agreement and click on Next.

  7. You have an option to change the directory where you want to install Nessus. Click on Next to proceed further.

  8. Click on Install to proceed further.

  9. During the installation, you might get one more prompt saying Would you like to install this device software?. Select the checkbox Always trust software from Tenable network security Inc. if you need to trust all software from Tenable. This option is not mandatory to select. Click on Install on this security window pop up to proceed further.

  10. The following screenshot indicates successful installation. Click on Finish to proceed further:

Post successful Nessus installation, it takes you to basic configurations such as default settings, user creations, and activation code.

The following screenshot shows the web view of the Nessus installed. Nessus runs on port 8834 by default:

Nessus warns about the SSL certificate. It doesn't come with an SSL certificate by default. Nessus administrators have to get an SSL certificate to configure Nessus with SSL.

If you want to install an SSL certificate now itself, install it; otherwise, click on Proceed anyway. This will take you to the kind of introduction page to begin with.

Click on Get Started to proceed further.

The first thing you need to do after this is the administrative account setup. This account is created on the Nessus server. This account should always be remembered for Nessus administration.

After the administrative account creation, Nessus will prompt for plugin feed registration and proxy settings, which is optional.

Plugin feed registration has to be done as per your anticipated use. After registration, you get an activation code that you need to use for plugin subscription.

Installing Nessus on Linux

For the latest Nessus package, either for buying or evaluation purposes, you should visit Tenable Nessus's official website at http://www.tenable.com/:

  1. Log in to the Nessus website to buy and download the latest Nessus software from the Products section as per your operating system and version. The steps outlined here are for Red Hat Linux 5.2.

  2. Once you have downloaded the Nessus executable file (the Nessus setup package), double-click on it to start the installation procedure. Administrative/root rights are required for installation.

    You will see the Installing packages window shown in the following screenshot:

  3. Click on the Apply button.

  4. Click on Install anyway to proceed further with the installation.

    The preceding screenshot shows that Nessus is installed successfully on the Red Hat Linux environment. To begin with this, the Nessus service should be started.

  5. The following command should be executed to start the Nessus service on the Linux terminal:

    # /sbin/service nessusd start
    

    The following screenshot shows the Nessus service starting up with the status OK:

  6. To configure the Nessus scanner, type the URL https://localhost.localdomain:8834/ into the Linux box web browser.

    This page displays the secure connection error, which can be rectified by adding an exception to the web browser.

  7. Click on the Or you can add an exception link.

  8. Click on Add Exception and on Get Certificate. This will activate the button Confirm Security Exception. Once you click on this , the web browser will display the Nessus scanner home page.

To configure further, the same steps as outlined for the Windows installation can be followed for registration, activation, updating plugins, user management, and so on.

 

Definition update


Updating Nessus definitions (plugins) is important as this keeps Nessus updated and able to identify all the latest vulnerabilities. To conduct a successful vulnerability scan with Nessus, it is important to check and update Nessus with the latest plugins before conducting scans.

To update Nessus on a Windows machine, the following steps should be performed:

  1. Log in to the Nessus server with the administrator account.

  2. Click on the Configuration tab from the top menu bar.

  3. After clicking on the Configuration tab, Nessus will open up the system configuration settings. This will have subtabs, namely General Settings, Feed Settings, Mobile Settings, Results Settings, and Advanced Settings.

  4. Click on the Feed Settings tab on the left-hand selection panel. This will open up a page to update the Nessus plugins feed.

Nessus provides multiple feed options as follows:

  • Online plugin updates

  • Offline plugin updates

  • Custom plugins feed host-based updates

Online plugin updates

Online plugin update is the most popular option for updating Nessus plugins and provides the ability to update the plugins through the Internet. This requires an Internet connection of fairly good speed on the Nessus machine. After Nessus registration and activation, plugins can be updated by clicking on the Update Plugins button.

Offline plugin updates

Offline plugin update is used when plugins are archived in a local directory from where Nessus can take the feed and update. This doesn't need an Internet connection on the Nessus system. To set up an offline update, first get the Nessus subscription activation code, which can be retrieved from Nessus support or the registered e-mail ID used for Nessus feed registration.

The next step is to generate a challenge code that is used to download plugins along with the activation code.

To generate the challenge code on a Windows Nessus machine, run the following command in the command-line tool:

\Program Files\Tenable\Nessus> nessus-fetch.exe --challenge

For a Linux Nessus machine, the command is slightly different; the following command should be run on a Linux terminal:

# /opt/nessus/bin/nessus-fetch --challenge

This will generate a long string of characters, which is called a challenge code. An example challenge code is 19c4ed603ac3e436a14239852c8fbf8f26f02d7b.

In order to continue downloading plugins offline, go to the Nessus plugins offline download page at https://plugins.nessus.org/offline.php. Once loaded, the page prompts for the challenge code and activation code. Enter these in.

Custom plugins feed host-based updates

A custom plugins feed host can be set up using this option. The hostname or host IP address can be provided to set this up.

 

User management


User management is an additional feature provided by Nessus that is most useful for a large enterprise environment where Nessus is used by multiple people in multiple locations. In such an environment, this feature enables administrators to enable different levels of access for multiple users on the Nessus scanner.

Nessus provides two different roles for users as follows:

  • Administrator

  • Nonadministrator

An administrator role has access to all functionalities of Nessus, whereas a non-administrator role has limited access. The non-administrator role doesn't have access to user management, general settings, feed settings, and advanced settings.

While installing Nessus, an administrative user is created for Nessus administration. To proceed with Nessus user management, it is necessary to log in with this account as it has administrator privileges.

The URL https://localhost:8834/ can be browsed to on a Windows machine.

Enter the administrator username and password to sign in. This displays the home page of Nessus as shown in the preceding screenshot.

Multiple tabs will be displayed under the administrative login. Click on the Users tab to move further with user management activities.

In Nessus, user management provides the following options:

  • Adding a new user

  • Deleting an existing user

  • Changing the password for an existing user

  • Changing the role of an existing user

Adding a new user

Click on the New User button to add a new user.

This will display the new user prompt to set the username, password, and role for the new user as shown in the following screenshot:

Deleting an existing user

Delete User is a functionality used when a user is no longer required on the Nessus scanner. In such cases, select the user who needs to be deleted from the Users header and click on the Delete User button from the options displayed on the right-hand side.

Changing the password or role of an existing user

At times, an administrator receives requests to change passwords for users. It may be because a user has forgotten his/her password or because his/her role needs to be changed. In such cases, select the user for whom the password or role needs to be changed and double-click on that user. This will prompt you with the following window for a new password to be set or the role to be changed:

 

Nessus system configuration


Nessus system configuration settings can be referred to under the Configuration tab. This has five different groups of settings as follows:

  • General Settings

  • Feed Settings

  • Mobile Settings

  • Result Settings

  • Advanced Settings

General Settings

The General Settings tab can be seen under Configuration by logging in to Nessus with administrator privileges. There are two different options of General Settings that exist in the Setting Type dropdown:

  • SMTP Server

  • Web Proxy

The SMTP server settings allow you to configure the SMTP server with your Nessus server to send out results of completed scans by automated e-mails.

SMTP settings

Different settings for SMTP can be configured as per your SMTP configuration. SMTP settings are explained in the following table:

SMTP setting

Description

Host

The SMTP server hostname or IP.

Port

The port number to connect the SMTP server.

From (Sender email)

E-mail ID from the report e-mails should appear as a sender.

Auth Method

The SMTP authentication method.

Username

The username with which to authenticate to the SMTP server.

Password

The password corresponding with this username.

Nessus Server Hostname

This is only for the e-mail links, Nessus server hostname, or IP address to be specified.

Send Test Email

Lets you test by sending a test e-mail.

Web proxy settings

Some organizations host a web proxy server between the external and internal networks to pass the traffic through. To update Nessus with the latest plugins in a web proxy environment, it is necessary to configure web proxy settings as per organization setup. This enables Nessus to reach the Nessus plugin server over the Internet to download the latest plugins.

Different settings for the web proxy can be configured as per your web proxy configuration. These settings are explained in the following table:

Web proxy setting

Description

Host

The proxy hostname or IP.

Port

The port number for the proxy to connect.

Username

The username to connect the proxy to.

Password

The password for the username to connect the proxy to.

User-agent

Required if the proxy uses filter-specific HTTP user agents. The custom user agent string needs to be specified.

Feed Settings

Feed Settings is explained in the Definition update section in this chapter.

Mobile Settings

The issue of mobile device security has become the priority in recent times with the widespread use of mobile devices in the corporate domain with concepts such as Bring Your Own Device (BYOD) being used proactively. Such devices when connected to corporate networks bring with them the inherent vulnerabilities of their mobile platforms. Nessus offers a mobile security scanning option where information and vulnerabilities for mobile devices recently connected to respective servers are scanned.

Currently, plugins related to the iPhone 4, the iPad, Windows Phone, and Android devices are included, and Nessus has the ability to scan Active Directory Service Interfaces (ADSI) and Apple Profile Manager to identify mobile devices connected to these servers, and to identify vulnerabilities.

The Mobile Settings tab presents options to configure the settings for the following type:

  • ActiveSync (Exchange)

  • Apple Profile Manager

  • Good For Enterprise

This can be seen in the following screenshot:

ActiveSync (Exchange)

Nessus can be configured to use ActiveSync for gathering information about all the mobile devices that use this protocol to fetch their e-mail (via Exchange). If you have an Exchange deployment, you can configure the domain controller settings, as listed in the following table:

ActiveSync mobile setting

Description

Domain Controller

The domain controller IP.

Domain

The domain name.

Domain Username

The username to connect the domain to.

Domain Password

The password for the username to connect to.

Apple Profile Manager

Nessus can be configured to use Apple Profile Manager for gathering information about all the iOS devices. If you have Apple Profile Manager deployed, you can configure the Apple Profile Manager settings, as listed in the following table:

Apple Profile Manager mobile setting

Description

Apple Profile Manager server

The Apple Profile Manager server IP.

Apple Profile Manager port

The Apple Profile Manager server port to connect to.

Apple Profile Manager username

The username to log in with.

Apple Profile Manager password

The password that corresponds with the username.

SSL

Check/uncheck this option based on the environment.

Verify SSL Certificate

Check this option if you want the SSL certificate to be verified.

Force Device Updates

Check this option if you want a device update to be forced.

Device Update Timeout (Minutes)

The device update timeout in minutes.

Good For Enterprise

Nessus can be configured to use Good Mobile device management for gathering information about all the mobile devices that use this protocol. If you have Good For Enterprise deployed, you can configure the settings listed in the following table:

Good For Enterprise mobile setting

Description

GMC Server

The GMC server IP needs to be mentioned here.

Port

The port number to use to connect with the GMC server.

Domain

The domain name.

Username

The username to connect with.

Password

The password that corresponds with the username.

SSL

Check/uncheck this option based on the environment.

Verify SSL Certificate

Check this option if you want a device to be verified.

Result Settings

Result Settings can be seen under Configurations. This allows you to add rules to disable plugins or change their severity.

The following screenshot shows how to add a new plugin rule:

The following table illustrates the new plugin rule options in detail:

New plugin rule option

Description

Host

If the result plugin rule is only for a particular IP/host, the host can be mentioned in the Host field. If the rule is to be applied for the entire host scanned, this can be left blank.

Plugin ID

The plugin ID to be provided to specify which plugin the rule is for.

Expiration Date

The expiration date for a rule can be specified here in case it needs to expire on a particular date.

Severity

Severity can be set from the dropdown as per the rule you want to set. It may be Hidden, Informational, Low, Medium, High, or Critical.

Advanced Settings

The Nessus GUI configuration menu contains several configurable options.

It is recommended that these settings be reviewed and modified appropriately based on your scanning environment. The option can be changed and saved using the Save button or can be removed altogether using the X sign present next to the option.

Special care should be taken while modifying the max_hosts and max_checks values in the upcoming table. These values represent the maximum number of checks and hosts being scanned at one time and have a direct impact on the scanning to be performed. The max_checks value, if greater than 5, can have an adverse impact on target servers, so it should be avoided. Similarly, a high value of max_hosts can overwhelm the host scanning system, and it depends on the capacity of the host on which Nessus is installed. It is recommended that this value also be kept relatively low (can start with 10); it can be optimized as per the environment and system capability.

The following screenshot shows some of the options from the table following it; options can be added or removed using the Add Settings tab and the X button respectively.

The advanced setting options and their uses as per the Nessus documentation are mentioned in the following table:

New plugin rule options

Description

The default value

allow_post_scan_editing

If enabled, post scan editing is possible.

Yes

auto_enable_dependencies

Automatically activates the plugins that depend on it. If disabled, not all plugins may run despite being selected in the scan policy.

Yes

auto_update

Controls automatic plugin updates. If enabled and Nessus is registered, it fetches the newest plugins from plugins.nessus.org automatically. Disable if the scanner is on an isolated network not able to reach the Internet.

Yes

auto_update_delay

The number of hours to wait between two updates. Four hours (4) is the minimum allowed interval.

24

cgi_path

During the testing of web servers, use the colon-delimited list of CGI paths.

/cgi-bin:/scripts

checks_read_timeout

Lets you specify the read timeout for the sockets of the tests.

5

disable_ntp

Disables the old NTP legacy protocol.

Yes

disable_xmlrpc

Disables the new XMLRPC (web server) interface.

No

Dumpfile

Lets you specify the location of a dump file for debugging output if generated.

C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.dump

global.max_hosts

The maximum number of hosts that can be scanned.

130

global.max_scans

If set to nonzero, this allows you to define the maximum number of scans that may take place in parallel.

0

global.max_simult_tcp_sessions

The maximum number of simultaneous TCP connections

50

global.max_web_users

If set to nonzero, this defines the maximum of (web) users that can connect in parallel.

1024

listen_address

The IPv4 address to listen for incoming connections. If set to 127.0.0.1, this will restrict access to local connections only.

0.0.0.0

listen_port

The port to listen for (the old NTP protocol). Used for pre-4.2 NessusClient connections.

1241

log_whole_attack

Allows you to log every detail of the attack and is helpful for debugging issues with the scan, but this may be disk intensive.

No

Logfile

Where the Nessus logfile is stored.

C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.messages

max_checks

The maximum number of simultaneous checks against each host tested.

5

max_hosts

The maximum number of hosts checked at one time during a scan.

5

nasl_log_type

Direct the type of NASL engine output in nessusd.dump.

Normal

nasl_no_signature_check

Allows you to specify whether Nessus should consider all NASL scripts as being signed. Selecting Yes is unsafe and is not recommended.

No

non_simult_ports

Lets you speficy those ports against which two plugins should not be run simultaneously.

139, 445, 3389

optimize_test

Lets you optimize the test procedure. Changing this to No will cause scans to take longer and typically generate more false positives.

Yes

plugin_upload

Lets you designate whether administrator users may upload plugins.

Yes

plugins_timeout

The maximum lifetime of a plugin's activity (in seconds).

320

port_range

The range of ports the port scanners will scan. Can use the keywords the Default or All as well as a comma-delimited list of ports or ranges of ports.

Default

purge_plugin_db

Lets you specify whether Nessus should purge the plugin database at each update. This directs Nessus to remove, redownload, and rebuild the plugin database for each update. Choosing Yes will cause each update to be considerably slower.

No

qdb_mem_usage

Directs Nessus to use more or less memory when idle. If Nessus is running on a dedicated server, setting this to High will use more memory to increase performance. If Nessus is running on a shared machine, setting this to Low will use considerably less memory, but at the price of a moderate performance impact.

Low

reduce_connections_on_congestion

Lets you reduce connections in case of congestion.

No

report_crashes

Allows you to specify whether to anonymously report crashes to Tenable.

Yes

Rules

The location of the Nessus rules file (nessusd.rules).

C:\ProgramData\Tenable\Nessus\conf\nessusd.rules

safe_checks

Safe checks rely on banner grabbing rather than active testing for a vulnerability.

Yes

silent_dependencies

If this is enabled, the list of plugin dependencies and their outputs are not included in the report. A plugin may be selected as part of a policy that depends on other plugins to run. By default, Nessus will run those plugin dependencies but will not include their outputs in the report. Setting this option to No will cause both the selected plugin and any plugin dependencies to appear in the report.

Yes

slice_network_addresses

If this option is set, Nessus will not scan a network incrementally (10.0.0.1, then 10.0.0.2, then 10.0.0.3, and so on) but will attempt to slice the workload throughout the whole network (for examaple, it will scan 10.0.0.1, then 10.0.0.127, then 10.0.0.2, then 10.0.0.128, and so on).

No

ssl_cipher_list

Makes sure that only "strong" SSL ciphers are used while connecting to port 1241. Supports the keyword strong or the general OpenSSL designations as listed at http://www.openssl.org/docs/apps/ciphers.html.

Strong

stop_scan_on_disconnect

Lets you stop scanning a host that seems to have been disconnected during the scan.

No

stop_scan_on_hang

Lets you stop a scan that seems to be hung up.

No

throttle_scan

The throttle scan is for when the CPU is overloaded.

Yes

www_logfile

Lets you specify where the Nessus web server (user interface) log is stored.

C:\ProgramData\Tenable\Nessus\nessus\logs\www_server.log

xmlrpc_idle_session_timeout

The idle session timeout for Nessus.

30

xmlrpc_listen_port

The port for the Nessus web server to listen for (the new XMLRPC protocol).

8834

All these advanced settings need to be analyzed properly before being applied. The recommended settings may vary from environment to environment.

A few sections of this chapter, which are specific configuration settings, have been referenced from learning material available on Nessus website: http://www.tenable.com.

 

Summary


In this chapter, we learned the basics about Vulnerability Assessment and Penetration Testing as well as had an introduction to Nessus.

VA and PT are key types of technical risk assessment, where VA concentrates on finding weaknesses or vulnerabilities in the infrastructure and PT goes to the next level to exploit these vulnerabilities.

Such assessments are carried out as preventive control to identify and mitigate vulnerabilities or out of various compliance requirements. Key activities for such tests include scoping, information gathering, vulnerability scanning, false positive analysis, vulnerability exploitation (Penetration Testing), and report generation. Scoping includes a different approach to testing Blackbox (no information about infrastructure) and Greybox (credentials and details about infrastructure are shared).

In this chapter, we also got an introduction to Nessus as one of the widely-used vulnerability scanners. It uses security checks, called plugins, against which vulnerabilities are identified during a scan. The key plugin family includes Windows, Linux, Solaris, Cisco, and Databases. Over the years, Nessus has added features such as configuration and compliance checks, apart from the primary functionality of the vulnerability scanner.

Nessus can be installed on all the major operating systems and detailed steps for installing Nessus on Windows 7 and Linux OS—along with the prerequisites—are mentioned in this chapter.

During initial setup, the initial administrator account is created to log in to Nessus as the administrator, and based on the requirement, the home or professional feed is activated.

This is followed by updating the plugin. The option to update plugins offline is also explained. Nessus offers a user management section to create Nessus users and grant those privileges for future use. Finally, Nessus system configuration settings such as Feed Settings, Mobile Settings, and Advanced Settings were introduced.

In the next chapter, we will learn about scanning the IT infrastructure using Nessus.

About the Author

  • Himanshu Kumar

    Himanshu Kumar is a very passionate security specialist with multiple years of experience as a security researcher. He has hands-on experience in almost all domains of Information Security specializing in Vulnerability Assessment and Penetration Testing. He enjoys writing scripts to exploit vulnerabilities.

    Browse publications by this author

Latest Reviews

(1 reviews total)
Good
Book Title
Unlock this book and the full library for FREE
Start free trial