Performing an Authenticated Vulnerability Scan
In this section we will perform an authenticated vulnerability scan
by providing credentials to Nessus.
As we discussed previously, authenticated scans produce more detailed information
and reduce the number of false positives.
To demonstrate this, we will use an authenticated vulnerability scan
against the target DESKTOP.
To begin, we’ll click New Scan on the Nessus dashboard.
Even though all Nessus templates accept user credentials,
we’ll use the Credentialed Patch Audit scan template,
which comes preconfigured to execute local security checks against the target.
The difference between this and the Basic Network Scan template
with provided credentials, is that the Credentialed Patch Audit scan only uses
local security checks and will not do a regular vulnerability check
from an external perspective.
The Credentialed Patch Audit template will not only scan for missing
operating system patches, but also for outdated applications,
which may be vulnerable to privilege escalation attacks.
Once again, we will provide a name for the scan and set the target to DESKTOP’s
IP address.
Next, let’s click on the Credentials tab and select SSH in the Host category.
On the Authentication method dropdown, we’ll select password,
and enter “offsec” as the username and “lab” for the password.
We’ll select sudo for the Elevate privileges with option and enter “root”
as the sudo user and “lab” as the password.
While we will use the SSH configuration for this example
there are several other authentication mechanisms available.
To get a list of all available mechanisms,
we can click the Categories dropdown menu and select All.
For example, the database authentication mechanisms option is now available.
We can consult the Tenable Documentation for a complete list
of supported authentication mechanisms.
For Linux and macOS targets, SSH is used.
While we can also use SSH on Windows, in most cases,
we will use Server Message Block and Windows Management Instrumentation
to perform authenticated vulnerability scans against Windows targets.
Both methods allow us to use local or domain accounts
and different authentication options.
To get meaningful results in an authenticated vulnerability scan,
we need to ensure that our target system is configured correctly.
Depending on the authentication method we want to use,
we need to make sure that there is no firewall blocking connections
from our scanner.
Furthermore, we often find antivirus programs installed
on both Linux and Windows targets.
AV may flag the vulnerability scan as malicious and therefore,
terminate our connection or render the results useless.
Depending on the AV program,
we can add an exception for the authenticated scan
or temporarily disable it.
Another Windows security technology we need to consider is User Account Control.
UAC is a security feature for Windows that allows users to use
standard privileges instead of administrator privileges.
An administrative user will run most applications and commands in standard
privileges and receive administrator privileges only when needed.
Due to the nature of UAC, it can also interfere with our scan.
We can configure UAC to allow Nessus or temporarily disable it.
We should consult the Tenable Documentation,
especially for Windows targets, before we start our first authenticated scan.
Our scan target is a Linux system without AV.
Therefore, we can click Save and launch the scan.
After the scan has finished, we can review the results.
On the Vulnerabilities page,
we get a list of the findings for the authenticated scan.
In the last section, we had already grouped findings with the MIXED severity.
For our authenticated scan,
let’s disable the grouping of findings by clicking on the wheel and selecting
Disable Groups.
After we disable groups, each finding is listed separately.
We get a list of vulnerabilities from the Ubuntu Local Security Checks
plugin family.
Plugins grouped into plugin families check for vulnerabilities in the same context.
For example, there are separate plugin families for checking vulnerabilities
in databases, firewalls, or web servers.
The Ubuntu Local Security Checks plugin family contains a multitude of plugins
that check for local vulnerabilities and missing patches for Ubuntu.
The Name column provides us with the vulnerable Ubuntu versions
and a brief description as well as the patch number for the vulnerabilities.
The list also contains vulnerability data of locally exposed applications
such as Firefox or cURL.