Performing a Vulnerability Scan
In this section we will perform our first vulnerability scan.
To begin, let’s click on the New Scan button on the dashboard in the Scans tab.
Nessus provides a list of the different templates.
For this section, we will use the Basic Network Scan,
which we can launch by clicking on it.
This will present the scan configuration settings screen containing the
BASIC, DISCOVERY, ASSESSMENT, REPORT, and ADVANCED settings.
The default screen is the General settings page with two required arguments:
a name for our scan and a list of targets.
Nessus supports multiple target specifications,
including a single IP address, an IP range,
and a comma-delimited Fully-Qualified Domain Name (FQDN),
or an IP address list.
For this example, we will scan the following machines:
POULTRY, JENKINS, WK01, and SAMBA.
We will enter “Basic Vulnerability Scan” into the Name field,
and the IP addresses of the machines into the Targets field.
Since we chose the Basic Network Scan template,
Nessus has already configured most of the settings for us.
However, the default configuration might not be exactly what we need.
Depending on the scanning type, the environment,
time constraints, and the targets,
we may need to adapt the settings to fit our needs.
In the default settings of this template, Nessus scans a list of common ports.
For this demonstration, we only want to scan ports 80 and 443.
To do this, let’s click on the Discovery settings
and select Custom in the dropdown menu.
After we click on Custom, additional configuration menus appear
under the DISCOVERY menu.
We can now customize the Basic Network Scan template
the same way as the Advanced Scan template in the context
of the DISCOVERY menu.
Within the Port Scanning section,
we will set the Port scan range to “80,443”.
Additionally, we’ll enable the option Consider unscanned ports as closed
so that Nessus treats other ports as closed,
since we are only interested in ports 80 and 443.
In this demonstration, we’ve customized the Basic Network Scan template
to only scan two specific TCP ports.
Even in the default settings of this template however,
Nessus does not scan UDP ports.
If we want to activate UDP port scanning, we need to manually configure it.
We may miss crucial information on UDP services
when it’s disabled during assessments,
but we need to understand that activating UDP port scanning
will vastly increase the scan duration.
Due to the nature of UDP, it is not often possible to tell the difference
between an open and a filtered port.
To save time and scan the targets more quietly,
we will turn off Host Discovery because we know the hosts are available.
We do this by navigating to Discovery > Host Discovery
where we toggle Ping the remote host to Off.
During the configuration of the scan definition,
we did not configure any credentials,
which implies that this scan will run unauthenticated.
We also didn’t change the default settings of the ASSESSMENT menu in the
Basic Network Scan template.
This means the brute forcing of user credentials will not be performed.
Even though brute forcing is disabled, our scan creates a lot of network traffic
and because we’re scanning multiple hosts, will be highly noticeable.
Now that we have a basic understanding of how we can
customize templates to fit our needs, we can launch our first scan.
We can do this by clicking on the arrow next to Save and selecting Launch.
Initially, the scan will have a status of Running in the Nessus dashboard
under My Scans.
We also have the options to stop or pause the scan.
Once the scan is finished, the status will change to Completed.
This concludes our first vulnerability scan with Nessus.
In the next Learning Unit, we’ll examine the results of the scan.