Hacking

Vulnerability Scanning with Metasploit Part I

Metasploit Framework, the Metasploit Project's best-known creation, is a software platform for developing, testing, and executing exploits. It can be used to create security testing tools and exploit modules and also as a penetration testing system. It was originally created as a portable network tool in 2003 by HD Moore. It is one of the most popular penetration testing tools among all security researchers and hackers. Apart from penetration testing, this tool also performs a very good vulnerability assessment in network and web applications. It has inbuilt plug-ins for some famous vulnerability scanners, such as Nessus, Nexpose, Open VAS, and WMAP.

In this article, we are going to see how to perform vulnerability assessments of network and web application by using Metasploit built-in plug-ins. First we will start with Nessus; before jumping into msfconsole, we will see how to install Nessus in BackTrack. It is quite easy; just follow the commands step by step:

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

First download the Nessus Linux version from its official website and install it. Then register for a free license. After successfully installing Nessus, add a user by typing the following command: /opt/nessus/sbin/nessus-adduser

After triggering the command, it will ask for a user login name and a user password. For user privileges, just follow the options and it is done.

Now we will register Nessus to obtain a license. So type in /opt/nessus/bin/nessus-fetch --register <YOUR LICENSE>

After registering, it will start downloading all latest plug-ins from its official website. It will take some time to complete the whole setup. After this, it will ready for use.

So let us launch msfconsole and type in load nessus.

As we can see in above figure, our Nessus plug-in is successfully loaded. Now type nessus_help and it will list all of the Nessus commands.<

Now we will connect to Nessus from our localhost to start the scans. For connecting to localhost, the command used is nessus_connect <Your Username>:<Your Password>@localhost:8834 <ok>, and here we are using nessus_connect rohit:toor@localhost:8834 ok.

As we can see here, our Nessus is authenticated. We will now check the Nessus scanning policies. For this, we type in nessus_policy_list.

My two policies, "Internal Network Scan" and "External Network Scan" are available. The first is used for scanning network vulnerabilities internally and the second is used for scanning network vulnerabilities externally.

Now we are going to scan our target machine. To scan a machine, we have to create a new scan. The command used is: nessus_scan_new <policy ID> <scan name> <Target IP>; for example, here we are using nessus_scan_new 2 NEW_SCAN 192.168.0.101,192.168.0.102

We can check the status of the scanning process by typing in nessus_scan_status, which will show us the status of the scanning process, whether it has completed or not. In our case, the scan is still running, so we will wait for some time.

After a while, our scan is completed. Now we will check our report by typing nessus_report_list; as shown below, our scan is completed.

To open the report, we use the command nessus_report_hosts <report ID>; for example, here we are using nessus_report_hosts ff2b1531-6c18-0198-9029-59ddcdb6fc3f26566c9ad609d831:

In the above screenshot, we can see that the result for the machine with the IP 192.168.0.101 has a total severity of 85. This means the total number of vulnerabilities is 85.

The following are the classifications of the different vulnerabilities:

• Sev 0 indicates high-level vulnerabilities; there are 0.

• Sev 1 indicates medium-level vulnerabilities; there are 53.

• Sev 2 indicates low-level vulnerabilities; there are 20.

• Sev 3 indicates informational vulnerabilities; there are 12.

We may see the vulnerabilities in detail with the protocol name and services by using the command nessus_report_hosts_ports <Target IP> <Report ID>; for example, here we are using nessus_report_host_ports 192.168.0.101 ff2b1531-6c18-0198-9029-59ddcdb6fc3f26566c9ad609d831:

Now we are going to send this report to the Nessus console; for this, type in nessus_report_get ff2b1531-6c18-0198-9029 59ddcdb6fc3f26566c9ad609d831

As can be seen in the above figure, our report has been successfully imported. Now log in via Nessus Webconsole and we are able to see our imported reports.

Become a Certified Ethical Hacker, guaranteed!

Get training from anywhere to earn your Certified Ethical Hacker (CEH) Certification — backed with an Exam Pass Guarantee.

Learn More