We're going to revisit Nessus.
And in this case, we're going to look at it and actually dive
into some of the vulnerabilities,
rather than just looking at what the scans are
and what the reports look like.
We have our Nessus on this environment.
And we've done all these scans before.
If you don't remember doing the scans,
maybe you missed the initial lab in auditing fundamentals.
I suggest you go back there and see how to get through these.
Otherwise, the directions are in the instructions for the lab,
but we're going to dive into some of the important aspects.
Now, not make the same lab video twice.
In our advanced network scan, we scanned demo.ine.local
with a web app scan.
And in here we've got this CGI abuses.
And a phpMyAdmin prior to 4.8 SQLi vulnerability.
So there's SQL injection vulnerability
due to the fact that this is an old version prior to 4.8.6.
And the solution is fairly straightforward
here-- upgrade to 4.8.6 or later,
or apply patches referenced in the vendor advisories.
And we can look down.
There is CVE-2019-11768.
And this is from 2019 when that vulnerability came about.
Now, we went and looked to the National Vulnerability Database
for other vulnerabilities in the past video,
and now we're going to go look at it
in something that we found in Nessus.
So Nessus is a great tool.
You could use it on a pen test if it's allowed
and it's in scope.
And then you want to proof of concept
those things if that is also part of the expectation
for your pen test.
So now we have CVE-2019-11768, same thing, phpMyAdmin
before 4.9.0.1 instead of that 4.8.6, probably very similar,
again from June of 2019.
And this has a high criticality.
And let's dive into that.
This takes unauthenticated users and gives them
access to the database.
So it's a network attack with low complexity.
No privileges are required.
No user interaction is required with high confidentiality,
integrity, and availability.
It makes for a pretty beastly kind of vulnerability.
It's quite a good one for them to have
included in this web app.
It was made vulnerable so we have things to look at.
We can look at the links and see exactly what phpMyAdmin
recommends.
There's the weaknesses, and then the CPE,
and what Nessus utilized to identify the vulnerability.
Now, it is very useful once you find a vulnerability like this
to go ahead and do a proof of concept if it's within--
if it makes sense, if it's within the time
limit, and it's within the scope of your pen test.
So back in this environment, Nessus makes it easy for us.
It gives us the URL.
It's this demo.ine.local/phpmyadmin.
So if we visit that page, which we didn't have to log in
or anything, we just put that in.
It gave us access.
If we look at some of the tables,
there's a utility table.
And in here there is accounts.
And so it ran this, select all from accounts,
and it's sharing that without us ever authenticating.
You want these things hidden behind authentication
so people have to log in.
So people who need them get access to people
who don't don't get access.
Just because the version of this web app,
it gives unauthenticated access once you know what the page is.
This is like vulnerabilities from 1999.
These are just security through obscurity,
where if you don't know what the website is,
you won't be able to get to it.
You won't get access.
We want better security now.
So this is not good, because what you can see here
is we've got usernames, passwords, signatures,
first name, last name.
It even tells us if they are admins, SoSecret.
This is just bad.
This is really bad.
So we would want to share this.
We would want to make copies of this
during the pen test for use throughout the rest of the pen
test.
And this is one of those things where you want--
it's a critical finding.
You're going to want it highlighted.
And they need it remediated.
It doesn't necessarily mean they need it patched.
It doesn't mean they need to upgrade.
It means they need to find some solution
or accept the risk as an organization.
That's up to them.
But you can give them options, like patch, upgrade, hide,
get rid of this page.
You can have phpMyAdmin in the back end
without it being public.
Those are all options, all decent things.
But it's about making your suggestions
useful to your client.
Now, that's going to be it for this lesson.
We'll get into another way of looking at things not
with a vulnerability scanner.
We have scanned with Nmap before.
Let's go take a look at what that
looks like if we use it searching just
for vulnerabilities.